CVE-2015-2206: Fedoraproject Fedora

Medium severity, CVSS 5.0. EPSS: 3.3% chance of exploitation in the next 30 days.

libraries/select_lang.lib.php in phpMyAdmin 4.0.x before 4.0.10.9, 4.2.x before 4.2.13.2, and 4.3.x before 4.3.11.1 includes invalid language values in unknown-language error responses that contain a CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.

Affected products

• Fedoraproject Fedora: version 20 only; version 21 only; version 22 only
• phpMyAdmin phpMyAdmin: version 4.0.0 only; version 4.0.1 only; version 4.0.2 only; version 4.0.3 only; version 4.0.4 only; version 4.0.4.1 only; …

Published 2015-03-09. Last modified 2026-06-17.