{"id":"GHSA-w8qg-j9fp-hrjf","summary":"phpMyAdmin Improper Input Validation","details":"The checkHTTP function in libraries/Config.class.php in phpMyAdmin 4.5.x before 4.5.5.1 does not verify X.509 certificates from api.github.com SSL servers, which allows man-in-the-middle attackers to spoof these servers and obtain sensitive information via a crafted certificate.","aliases":["CVE-2016-2562"],"modified":"2024-04-24T18:11:36.251966Z","published":"2022-05-17T03:31:14Z","database_specific":{"github_reviewed_at":"2024-04-24T17:20:56Z","nvd_published_at":"2016-03-01T11:59:00Z","cwe_ids":["CWE-20"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2562"},{"type":"WEB","url":"https://github.com/phpmyadmin/phpmyadmin/commit/e42b7e3aedd29dd0f7a48575f20bfc5aca0ff976"},{"type":"PACKAGE","url":"https://github.com/phpmyadmin/composer"},{"type":"WEB","url":"https://www.phpmyadmin.net/security/PMASA-2016-13"},{"type":"WEB","url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178562.html"},{"type":"WEB","url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178869.html"}],"affected":[{"package":{"name":"phpmyadmin/phpmyadmin","ecosystem":"Packagist","purl":"pkg:composer/phpmyadmin/phpmyadmin"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5"},{"fixed":"4.5.5.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-w8qg-j9fp-hrjf/GHSA-w8qg-j9fp-hrjf.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N"}]}