Unrated
An issue was discovered in phpMyAdmin involving the %u username replacement functionality of the SaveDir and UploadDir features. When the username sub...
CVE-2016-6614
First seen on SecPulse
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2016-6614 phpmyadmin Fixed in: 4:4.6.4+dfsg1-1
Original description The description as published by the source.
An issue was discovered in phpMyAdmin involving the %u username replacement functionality of the SaveDir and UploadDir features. When the username substitution is configured, a specially-crafted user name can be used to circumvent restrictions to traverse the file system. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
- advisory securityfocus.com
- advisory security.gentoo.org
- patch phpmyadmin.net
- web lists.debian.org