CVE-2023-45196

Adminer and AdminerEvo denial of service via HTTP redirect

Medium6.9EPSS 0.58%

Published: 24 Jun 2024
Updated: 2 Aug 2024
Reserved: 5 Oct 2023
Assigned by: cisa-cg

Description

Adminer and AdminerEvo allow an unauthenticated remote attacker to cause a denial of service by connecting to an attacker-controlled service that responds with HTTP redirects. The denial of service is subject to PHP configuration limits. Adminer is no longer supported, but this issue was fixed in AdminerEvo version 4.8.4.

Scores

CVSS scores of CVE-2023-45196, by who scored it
Scored by	CVSS	Score	Vector
cisa-cgCNA (assigner)	4.0	Medium6.9	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/AU:Y
NVDNVD · Analyzed	4.0	Medium6.9	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.58% · top 52% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.9.

Weakness

CWE-400 Uncontrolled Resource Consumption (opens in a new tab)All about CWE-400 and its CVEs

Affected products

Adminer · Adminer
- affected ≤ *
- affected cpe:2.3:a:adminer:adminer:0:*:*:*:*:*:*:* – ≤ cpe:2.3:a:adminer:adminer:*:*:*:*:*:*:*:*
AdminerEvo · AdminerEvo
- affected 4.8.2 – < 4.8.4
- affected cpe:2.3:a:adminerevo:adminerevo:0:*:*:*:*:*:*:* – < cpe:2.3:a:adminerevo:adminerevo:4.8.4:*:*:*:*:*:*:*

References (1)

https://github.com/adminerevo/adminerevo/pull/102/commits/23e7cdc0a32b3739e13d19ae504be0fe215142b6 (opens in a new tab)patchx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2023-45196](https://trackcve.app/badge/CVE-2023-45196.svg)](https://trackcve.app/cve/CVE-2023-45196)

Record last updated 2 Aug 2024, 20:14 UTC.