GitHub Advisoryadvisory · Packagist

GHSA-6j2v-g9rg-qcm5 phpMyAdmin Local file exposure through symlinks with UploadDir

MEDIUM Published 2022-05-17 Modified 2024-04-24 Official page ↗
Aliases
CVE-2016-6613
Ecosystem
Packagist
Packages
phpmyadmin/phpmyadmin
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2024-04-24

Affected packages

• Packagist phpmyadmin/phpmyadmin: >= 4.6, < 4.6.4 → fixed in 4.6.4 • Packagist phpmyadmin/phpmyadmin: >= 4.4, < 4.4.15.8 → fixed in 4.4.15.8 • Packagist phpmyadmin/phpmyadmin: >= 4.0, < 4.0.10.17 → fixed in 4.0.10.17

Description

An issue was discovered in phpMyAdmin. A user can specially craft a symlink on disk, to a file which phpMyAdmin is permitted to read but the user is not, which phpMyAdmin will then expose to the user. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.

Related

Alias · CVE (1)

  • CVE-2016-6613 An issue was discovered in phpMyAdmin. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References