CVE-2016-4010 Deserialization in n/a

What is CVE-2016-4010?

CVE-2016-4010 is a critical unsafe deserialization vulnerability in Magento Magento, published on 23 Jan 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shopping cart data.

Weakness: CWE-74

Which versions are affected by CVE-2016-4010?

It affects 1 product.

Products include Magento Magento.

How do I fix CVE-2016-4010?

No fix has been published for CVE-2016-4010 yet. Limit exposure of the affected software until one is available.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2016-4010 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2016-4010 exists.

Public exploit code: 1 Metasploit module, 1 Exploit-DB entry and 2 proofs of concept on GitHub.

Other vulnerabilities in Magento Magento

• CVE-2020-9664 Magento php object injection vulnerability Critical 9.8
• CVE-2020-9576 Magento command injection vulnerability Critical 9.8
• CVE-2020-9578 Magento command injection vulnerability Critical 9.8
• CVE-2020-9579 Magento Security mitigation bypass vulnerability Critical 9.8
• CVE-2020-9580 Magento Security mitigation bypass vulnerability Critical 9.8

All Magento Magento vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2xwv-qj35-wxv7.