{"id":"GHSA-w8qg-j9fp-hrjf","aliases":["CVE-2016-2562"],"title":"phpMyAdmin Improper Input Validation","description":"The checkHTTP function in libraries/Config.class.php in phpMyAdmin 4.5.x before 4.5.5.1 does not verify X.509 certificates from api.github.com SSL servers, which allows man-in-the-middle attackers to spoof these servers and obtain sensitive information via a crafted certificate.","severity":"medium","score":6.8,"published":"2022-05-17T03:31:14.000Z","modified":"2024-04-24T18:11:36.251Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"phpmyadmin/phpmyadmin","ranges":[{"events":[{"introduced":"4.5"},{"fixed":"4.5.5.1"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["4.5.5.1"]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2016-2562","https://github.com/phpmyadmin/phpmyadmin/commit/e42b7e3aedd29dd0f7a48575f20bfc5aca0ff976","https://github.com/phpmyadmin/composer","https://www.phpmyadmin.net/security/PMASA-2016-13","http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178562.html","http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178869.html"],"sources":[{"name":"OSV","id":"GHSA-w8qg-j9fp-hrjf","modified":"2024-04-24T18:11:36.251966Z","url":"https://osv.dev/vulnerability/GHSA-w8qg-j9fp-hrjf"}],"assessments":[{"source":"OSV","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","score":6.8}]}