Vulnerability Description
An issue was discovered in phpMyAdmin. Some data is passed to the PHP unserialize() function without verification that it's valid serialized data. The unserialization can result in code execution because of the interaction with object instantiation and autoloading. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Phpmyadmin | Phpmyadmin | 4.6.0 |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/95055
- https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html
- https://security.gentoo.org/glsa/201701-32
- https://www.phpmyadmin.net/security/PMASA-2016-43PatchVendor Advisory
- http://www.securityfocus.com/bid/95055
- https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html
- https://security.gentoo.org/glsa/201701-32
- https://www.phpmyadmin.net/security/PMASA-2016-43PatchVendor Advisory
FAQ
What is CVE-2016-6620?
CVE-2016-6620 is a vulnerability with a CVSS score of 9.8 (CRITICAL). An issue was discovered in phpMyAdmin. Some data is passed to the PHP unserialize() function without verification that it's valid serialized data. The unserialization can result in code execution beca...
How severe is CVE-2016-6620?
CVE-2016-6620 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2016-6620?
Check the references section above for vendor advisories and patch information. Affected products include: Phpmyadmin Phpmyadmin.