Denial-of-Service Vulnerability in phpMyAdmin
Summary
CVE-2016-6630: An issue was discovered in phpMyAdmin. Affects phpmyadmin across 61 version ranges.
< 1c1753bb6666381fa2cd2cd1f160286935244a35
< 1f1e63cd5956eca847891b28b24e90ceaeaeb009
< 1fe735d098d82ad79500eab04c4d25ba8fe25a24
< 2fecc279f5d51e00a203cd400ace24b6053969a4
< 3c96596f7d897e048be4c2c85d941aadd6141ba9
< 3df57a818917737d65e0e1c7cce80e9eb69e5e0b
< 3fc737460caa3c47d9d51751d712cc8784b1dfef
< 4.4.15.8-r0
< 5b0543da6915bac44cb15e7e73f9e1886fe57588
< 5b2b959a40ddd728d5ef4c6b09f118038c5e8af0
< 5e5261284190c6fe6985547fbd19d3345df14be1
< 6ab95d9bec50f6be6b5439abed35f99ab3fa5cbc
< 6da64cc3b2ba4439574f914f51e161645375be96
< 07fd0bce678e83d5f81d7a683f1052fe45764d0c
< 13a288d0da6e79b99acb9052bcf31b6650c624b5
< 21eda1c2c42d28370b91c99017dcee7eef9691fd
< 32f512698518214fcc59ea45e0f35b0aedff16cb
< 35e191d74b50c8f5a7b87fa9889869cc3a88255d
< 37b38431d167915675fc8ab512470528147e72de
< 52b6cfde9f581ee6818db0e3f5d80db8c29dfa34
< 64c2b9a59c09e4a04be2238553c3fcfbc58b7949
< 66aba31923f26124e06b2a55b837e4fd47c5ef1d
< 78a6214afcee3a6b65eb5e1ac261aa8e70f36736
< 86a7d2704994c43a4fae11cf38105fc3cb3d4d5b
< 243ed0268fa15567c8a787eeb6055a232102b91a
< 409c9bc50aa447c52d334c839f4aa239f66c5e03
< 426c5d9c1ded024c9306428ce165ae82d6f6d5df
< 00828f9ccb1024fbcd528f41dfdf28fab918dfff
< 2189c875356fc1af21c6da32235bf24f60f53b96
< 2694c36ef6e86de019196698a9de1953645fba97
< 5004dc40980b8dfe04c328abed85fde991833624
< 16136ea0ef224ed22c3dffd629e3e147579f5f38
< 82161a6c30a9ac2502d822e29cfb66beae7eeb4c
< 83416df64f2277d8853fcdd048df7bb154514d03
< 95104ff56e15876c6b481e09c9f0169e34b781f8
< 5118938f103e0022329847b654fcd99c8cb37de7
< 66149607b1b578bbedc0a90e3c000e8c410c7c8e
< a1b4ecc69bc4ac90a54e3f3c8644ca18f13b010d
< a62fcf03af4c7f9df2393fbe58ae8653166763fa
< a395665715a3f56db9692486d120fb1dc00bcc5d
< ad54449d105365dbbd39ae879306f1037fe238cd
< b0d60e271a6f47d2e0ecd81ad620b5d185acc0b1
< b1cc43ee7f8607c80889570912c5a54b7409b4d1
< b7c2e99987c2c52c6e8010b55b75f3c1c039216a
< b8f86592e900310f0b39d8e5270b26bebd0cfad8
< b478a3d5c4fc1341a0a77235d2afbd2b4e4d0a6c
< c68478ad7d0523e42aa789ba24ea5f9018510047
< c21937440af0b0b2ed752f229c3d2523ac178d85
< ceb7d7e1b2f8ab1e61710d0d061f10193a6c44c5
< d0f7dc79905f4795d328a018772871f9f98957fc
< d8f4a2d661f78281db7ee6826651ffc9574a2b31
< d81165f34555c5202d8150ae1d080834dd601d5b
< daf86cd1e369f63ad132d8dc63a7217267030408
< dba2af651a53d5037296a1dc827081a94ef1062c
< e0c1ed02a11b4ed46d82a31b7f95030854865add
< e4db51c0d47ac6e319ba93ce0d5706a33f736c00
< f2db92434b71973a1281dfbaec8837e51e602c77
< f7f483e99a74648843cc87265033442aeb4b7342
< f86761326c97eb5e2c9cefa2b1871252357f00a0
< f1668937772688de3bbd707cee23ef8653756f32
< fecf8b76ef831be0a5a8fddb1c3edf4251e92076
Fixed in 4.4.15.8-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a popular open-source tool used for managing MySQL databases. It provides a web-based interface for performing various database operations, such as creating tables, executing queries, and managing user permissions. The vulnerability identified as CVE-2016-6630 affects versions 4.6.x (prior to 4.6.4), 4.4.x (prior to 4.4.15.8), and 4.0.x (prior to 4.0.10.17) of phpMyAdmin. This vulnerability allows an authenticated user to trigger a denial-of-service (DoS) attack by entering an excessively long password at the change password dialog.
Vulnerability Detail
The CVE-2016-6630 vulnerability in phpMyAdmin allows an authenticated user to exploit the change password dialog by entering a very long password. This triggers a DoS attack, causing the application to become unresponsive or crash. The impact of this vulnerability can disrupt the availability of the phpMyAdmin service, potentially affecting other users who rely on it for database management. The vulnerability has a CVSSv3 score of 6.5, indicating a medium severity level.
How To Fix
Minimum fixed version
4.4.15.8-r0
This is the first release that contains the fix.
sudo apk add --upgrade phpmyadminTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the change password dialog by limiting it to trusted users or disabling the feature altogether. This can be achieved by modifying the phpMyAdmin configuration file or implementing access control rules at the web server level. However, applying the official patch or updating to a fixed version is the recommended solution.
Conclusion
The CVE-2016-6630 vulnerability in phpMyAdmin poses a risk of denial-of-service attacks. It is crucial to update to the latest patched version or apply the official fix to ensure the security and availability of the phpMyAdmin service. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin →
FAQ
phpMyAdmin is an open-source tool used for managing MySQL databases through a web-based interface. It simplifies tasks such as database creation, querying, and user management.
Users of phpMyAdmin versions 4.6.x (prior to 4.6.4), 4.4.x (prior to 4.4.15.8), and 4.0.x (prior to 4.0.10.17) are affected by this vulnerability.
The vulnerability allows an authenticated user to trigger a denial-of-service attack, potentially causing the phpMyAdmin service to become unresponsive or crash.
To fix this vulnerability, update phpMyAdmin to version 4.6.4, 4.4.15.8, or 4.0.10.17. These versions contain the necessary patches to mitigate the DoS vulnerability.
As a temporary workaround, access to the change password dialog can be restricted to trusted users or disabled completely. However, applying the official patch or updating to a fixed version is recommended.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin.
