CVE-2016-6623 phpMyAdmin DoS Vulnerability
An authorized user can cause a denial-of-service attack on the server by passing large values to a loop in phpMyAdmin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-6623?
CVE-2016-6623 is a medium-severity denial of service vulnerability in Phpmyadmin Phpmyadmin, published on 11 Dec 2016. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An issue was discovered in phpMyAdmin. An authorized user can cause a denial-of-service (DoS) attack on a server by passing large values to a loop. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
Weakness: CWE-20
Which versions are affected by CVE-2016-6623?
6 open source packages ship an affected version, including phpmyadmin/phpmyadmin. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
phpmyadmin/phpmyadmin Packagist | From 4.0.0 | 4.0.10.17 |
phpmyadmin/phpmyadmin Packagist | From 4.0.0 | 4.0.10.17 |
phpmyadmin/phpmyadmin Packagist | From 4.4.0 | 4.4.15.8 |
phpmyadmin/phpmyadmin Packagist | From 4.4.0 | 4.4.15.8 |
phpmyadmin/phpmyadmin Packagist | From 4.6.0 | 4.6.4 |
phpmyadmin/phpmyadmin Packagist | From 4.6.0 | 4.6.4 |
Products include Phpmyadmin Phpmyadmin.
How do I fix CVE-2016-6623?
Upgrade phpmyadmin/phpmyadmin to a fixed version for your release line: 4.0.10.17, 4.4.15.8 or 4.6.4.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2016-6623 being exploited?
There is no known exploitation of CVE-2016-6623 in the wild and no public exploit code.
Other vulnerabilities in Phpmyadmin Phpmyadmin
Sources
Also known as ALPINE-CVE-2016-6623, DEBIAN-CVE-2016-6623, GHSA-2mcj-3r3r-v5wm, UBUNTU-CVE-2016-6623.