VYPR
← All advisories
High severity7.5NVD Advisory· Published Jul 3, 2016· Updated May 6, 2026

CVE-2016-5739

CVE-2016-5739

Description

The Transformation implementation in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not use the no-referrer Content Security Policy (CSP) protection mechanism, which makes it easier for remote attackers to conduct CSRF attacks by reading an authentication token in a Referer header, related to libraries/Header.php.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
phpmyadmin/phpmyadminPackagist
>= 4.0.10.0, < 4.0.10.164.0.10.16
phpmyadmin/phpmyadminPackagist
>= 4.4.15.0, < 4.4.15.74.4.15.7
phpmyadmin/phpmyadminPackagist
>= 4.6.0, < 4.6.34.6.3

Patches

2
2f4950828ec2

Update referrer <meta> to match current standards

https://github.com/phpmyadmin/phpmyadminMichal ČihařJun 20, 2016via ghsa
commit
1 file changed · +1 −1
  • libraries/Header.php+1 −1 modified
    @@ -639,7 +639,7 @@ private function _getHtmlStart()
     private function _getMetaTags()
     {
         $retval  = '<meta charset="utf-8" />';
-        $retval .= '<meta name="referrer" content="none" />';
+        $retval .= '<meta name="referrer" content="no-referrer" />';
         $retval .= '<meta name="robots" content="noindex,nofollow" />';
         $retval .= '<meta http-equiv="X-UA-Compatible" content="IE=Edge">';
         if (! $GLOBALS['cfg']['AllowThirdPartyFraming']) {
1e5716cb96d4

Add referrer CSP and <meta> tag

https://github.com/phpmyadmin/phpmyadminMichal ČihařJun 20, 2016via ghsa
commit
1 file changed · +4 −0
  • libraries/Header.php+4 −0 modified
    @@ -550,6 +550,7 @@ public function sendHttpHeaders()
             . $captcha_url
             . $GLOBALS['cfg']['CSPAllow']
             . ";"
+            . "referrer no-referrer;"
             . "img-src 'self' data: "
             . $GLOBALS['cfg']['CSPAllow']
             . $map_tile_urls
@@ -561,6 +562,7 @@ public function sendHttpHeaders()
             . $captcha_url
             . $GLOBALS['cfg']['CSPAllow'] . ';'
             . "options inline-script eval-script;"
+            . "referrer no-referrer;"
             . "img-src 'self' data: "
             . $GLOBALS['cfg']['CSPAllow']
             . $map_tile_urls
@@ -575,6 +577,7 @@ public function sendHttpHeaders()
             . $captcha_url
             . $GLOBALS['cfg']['CSPAllow']
             . " 'unsafe-inline' 'unsafe-eval';"
+            . "referrer no-referrer;"
             . "style-src 'self' 'unsafe-inline' "
             . $captcha_url
             . ';'
@@ -636,6 +639,7 @@ private function _getHtmlStart()
     private function _getMetaTags()
     {
         $retval  = '<meta charset="utf-8" />';
+        $retval .= '<meta name="referrer" content="none" />';
         $retval .= '<meta name="robots" content="noindex,nofollow" />';
         $retval .= '<meta http-equiv="X-UA-Compatible" content="IE=Edge">';
         if (! $GLOBALS['cfg']['AllowThirdPartyFraming']) {

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

12

News mentions

0

No linked articles in our index yet.