CVE-2006-4466: Input Validation
Joomla! before 1.0.11 does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to have an unspecified impact. NOTE: it could be argued that this vulnerability is due to a bug in the unset PHP command (CVE-2006-3017) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in Joomla!.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-4466?
CVE-2006-4466 is considered to have an unspecified severity level that may allow remote attackers to exploit the vulnerability.
How do I fix CVE-2006-4466?
To fix CVE-2006-4466, upgrade Joomla! to version 1.0.11 or later.
Which versions of Joomla! are affected by CVE-2006-4466?
CVE-2006-4466 affects Joomla! versions prior to 1.0.11, specifically 1.0.9 and up to 1.0.10.
What type of attack can CVE-2006-4466 facilitate?
CVE-2006-4466 may allow for remote attacks that can lead to unspecified impacts on the system.
Is CVE-2006-4466 still a concern for current Joomla! users?
No, CVE-2006-4466 is no longer a concern if users have updated to the latest version of Joomla!.