Vulnerability · Published Jun 24, 2024 · Assigned by cisa-cg
CVE-2023-45196Adminer and AdminerEvo denial of service via HTTP redirect
Medium 6.9
In plain English
A medium-severity uncontrolled resource consumption in Adminer from Adminer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Adminer and AdminerEvo allow an unauthenticated remote attacker to cause a denial of service by connecting to an attacker-controlled service that responds with HTTP redirects. The denial of service is subject to PHP configuration limits. Adminer is no longer supported, but this issue was fixed in AdminerEvo version 4.8.4.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | adminer | no fix listed | DEBIAN-CVE-2023-45196 |
| Debian:13 | adminer | 4.8.1-4 | DEBIAN-CVE-2023-45196 |
| Debian:14 | adminer | 4.8.1-4 | DEBIAN-CVE-2023-45196 |
| Ubuntu:22.04:LTS | adminer | no fix listed | UBUNTU-CVE-2023-45196 |
| Ubuntu:24.04:LTS | adminer | no fix listed | UBUNTU-CVE-2023-45196 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Adminer | Adminer | 0 – through *cpe:2.3:a:adminer:adminer:0:*:*:*:*:*:*:* – through cpe:2.3:a:adminer:adminer:*:*:*:*:*:*:*:* |
| AdminerEvo | AdminerEvo | 4.8.2 – before 4.8.4cpe:2.3:a:adminerevo:adminerevo:0:*:*:*:*:*:*:* – before cpe:2.3:a:adminerevo:adminerevo:4.8.4:*:*:*:*:*:*:* |
Weakness: CWE-400 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/AU:Y