CVE-2023-45195 - Vulnerability Details - OpenCVE

Adminer and AdminerEvo are vulnerable to SSRF via database connection fields. This could allow an unauthenticated remote attacker to enumerate or access systems the attacker would not otherwise have access to. Adminer is no longer supported, but this issue was fixed in AdminerEvo version 4.8.4.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Adminer	Adminer
Adminerevo	Adminerevo

No data.

No data.

References

Link	Providers
https://github.com/adminerevo/adminerevo/pull/102/commits/18f3167bbcbec3bc746f62db72e016aa99144efc

History

No history.

MITRE

Status: PUBLISHED

Assigner: cisa-cg

Published: 2024-06-24T21:06:09.735Z

Updated: 2024-08-02T20:14:19.950Z

Reserved: 2023-10-05T03:54:13.664Z

Link: CVE-2023-45195

Vulnrichment

Updated: 2024-08-02T20:14:19.950Z

NVD

Status : Awaiting Analysis

Published: 2024-06-24T22:15:10.060

Modified: 2024-11-21T08:26:31.617

Link: CVE-2023-45195

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-45195", "assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725", "state": "PUBLISHED", "assignerShortName": "cisa-cg", "dateReserved": "2023-10-05T03:54:13.664Z", "datePublished": "2024-06-24T21:06:09.735Z", "dateUpdated": "2024-08-02T20:14:19.950Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:adminer:adminer:0:*:*:*:*:*:*:*", "cpe:2.3:a:adminer:adminer:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "Adminer", "vendor": "Adminer", "versions": [{"lessThanOrEqual": "*", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThanOrEqual": "cpe:2.3:a:adminer:adminer:*:*:*:*:*:*:*:*", "status": "affected", "version": "cpe:2.3:a:adminer:adminer:0:*:*:*:*:*:*:*", "versionType": "cpe"}]}, {"cpes": ["cpe:2.3:a:adminerevo:adminerevo:4.8.2:*:*:*:*:*:*:*", "cpe:2.3:a:adminerevo:adminerevo:4.8.4:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "AdminerEvo", "repo": "https://github.com/adminerevo/adminerevo", "vendor": "AdminerEvo", "versions": [{"lessThan": "4.8.4", "status": "affected", "version": "4.8.2", "versionType": "custom"}, {"lessThan": "cpe:2.3:a:adminerevo:adminerevo:4.8.4:*:*:*:*:*:*:*", "status": "affected", "version": "cpe:2.3:a:adminerevo:adminerevo:0:*:*:*:*:*:*:*", "versionType": "cpe"}]}], "datePublic": "2024-04-07T15:37:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Adminer and AdminerEvo are vulnerable to SSRF via database connection fields. This could allow an unauthenticated remote attacker to enumerate or access systems the attacker would not otherwise have access to. <span style=\"background-color: var(--wht);\">Adminer is no longer supported, but this issue was fixed in AdminerEvo version 4.8.4.</span></p><p></p>"}], "value": "Adminer and AdminerEvo are vulnerable to SSRF via database connection fields. This could allow an unauthenticated remote attacker to enumerate or access systems the attacker would not otherwise have access to.\u00a0Adminer is no longer supported, but this issue was fixed in AdminerEvo version 4.8.4."}], "metrics": [{"cvssV4_0": {"Automatable": "YES", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.9, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/AU:Y", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9119a7d8-5eab-497f-8521-727c672e3725", "shortName": "cisa-cg", "dateUpdated": "2024-06-24T21:06:09.735Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/adminerevo/adminerevo/pull/102/commits/18f3167bbcbec3bc746f62db72e016aa99144efc"}], "source": {"discovery": "UNKNOWN"}, "title": "Adminer and AdminerEvo SSRF", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-25T14:34:53.587598Z", "id": "CVE-2023-45195", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-25T14:35:33.373Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T20:14:19.950Z"}, "title": "CVE Program Container", "references": [{"tags": ["patch", "x_transferred"], "url": "https://github.com/adminerevo/adminerevo/pull/102/commits/18f3167bbcbec3bc746f62db72e016aa99144efc"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/adminerevo/adminerevo/pull/102/commits/18f3167bbcbec3bc746f62db72e016aa99144efc", "tags": ["patch", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T20:14:19.950Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-45195", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-25T14:34:53.587598Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-25T14:35:29.501Z"}}], "cna": {"title": "Adminer and AdminerEvo SSRF", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/AU:Y", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:adminer:adminer:0:*:*:*:*:*:*:*", "cpe:2.3:a:adminer:adminer:*:*:*:*:*:*:*:*"], "vendor": "Adminer", "product": "Adminer", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "*"}, {"status": "affected", "version": "cpe:2.3:a:adminer:adminer:0:*:*:*:*:*:*:*", "versionType": "cpe", "lessThanOrEqual": "cpe:2.3:a:adminer:adminer:*:*:*:*:*:*:*:*"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:adminerevo:adminerevo:4.8.2:*:*:*:*:*:*:*", "cpe:2.3:a:adminerevo:adminerevo:4.8.4:*:*:*:*:*:*:*"], "repo": "https://github.com/adminerevo/adminerevo", "vendor": "AdminerEvo", "product": "AdminerEvo", "versions": [{"status": "affected", "version": "4.8.2", "lessThan": "4.8.4", "versionType": "custom"}, {"status": "affected", "version": "cpe:2.3:a:adminerevo:adminerevo:0:*:*:*:*:*:*:*", "lessThan": "cpe:2.3:a:adminerevo:adminerevo:4.8.4:*:*:*:*:*:*:*", "versionType": "cpe"}], "defaultStatus": "unknown"}], "datePublic": "2024-04-07T15:37:00.000Z", "references": [{"url": "https://github.com/adminerevo/adminerevo/pull/102/commits/18f3167bbcbec3bc746f62db72e016aa99144efc", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Adminer and AdminerEvo are vulnerable to SSRF via database connection fields. This could allow an unauthenticated remote attacker to enumerate or access systems the attacker would not otherwise have access to.\u00a0Adminer is no longer supported, but this issue was fixed in AdminerEvo version 4.8.4.", "supportingMedia": [{"type": "text/html", "value": "<p>Adminer and AdminerEvo are vulnerable to SSRF via database connection fields. This could allow an unauthenticated remote attacker to enumerate or access systems the attacker would not otherwise have access to. <span style=\"background-color: var(--wht);\">Adminer is no longer supported, but this issue was fixed in AdminerEvo version 4.8.4.</span></p><p></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "9119a7d8-5eab-497f-8521-727c672e3725", "shortName": "cisa-cg", "dateUpdated": "2024-06-24T21:06:09.735Z"}}}, "cveMetadata": {"cveId": "CVE-2023-45195", "state": "PUBLISHED", "dateUpdated": "2024-08-02T20:14:19.950Z", "dateReserved": "2023-10-05T03:54:13.664Z", "assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725", "datePublished": "2024-06-24T21:06:09.735Z", "assignerShortName": "cisa-cg"}, "dataVersion": "5.1"}

{"descriptions": [{"lang": "en", "value": "Adminer and AdminerEvo are vulnerable to SSRF via database connection fields. This could allow an unauthenticated remote attacker to enumerate or access systems the attacker would not otherwise have access to.\u00a0Adminer is no longer supported, but this issue was fixed in AdminerEvo version 4.8.4."}, {"lang": "es", "value": "Adminer y AdminerEvo son vulnerables a SSRF a trav\u00e9s de campos de conexi\u00f3n de base de datos. Esto podr\u00eda permitir que un atacante remoto no autenticado enumere o acceda a sistemas a los que de otra manera el atacante no tendr\u00eda acceso. Adminer ya no es compatible, pero este problema se solucion\u00f3 en AdminerEvo versi\u00f3n 4.8.4."}], "id": "CVE-2023-45195", "lastModified": "2024-11-21T08:26:31.617", "metrics": {"cvssMetricV40": [{"cvssData": {"attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "automatable": "YES", "availabilityRequirements": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirements": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "recovery": "NOT_DEFINED", "safety": "NOT_DEFINED", "subsequentSystemAvailability": "NONE", "subsequentSystemConfidentiality": "LOW", "subsequentSystemIntegrity": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnerabilityResponseEffort": "NOT_DEFINED", "vulnerableSystemAvailability": "NONE", "vulnerableSystemConfidentiality": "NONE", "vulnerableSystemIntegrity": "NONE"}, "source": "9119a7d8-5eab-497f-8521-727c672e3725", "type": "Secondary"}]}, "published": "2024-06-24T22:15:10.060", "references": [{"source": "9119a7d8-5eab-497f-8521-727c672e3725", "url": "https://github.com/adminerevo/adminerevo/pull/102/commits/18f3167bbcbec3bc746f62db72e016aa99144efc"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/adminerevo/adminerevo/pull/102/commits/18f3167bbcbec3bc746f62db72e016aa99144efc"}], "sourceIdentifier": "9119a7d8-5eab-497f-8521-727c672e3725", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "9119a7d8-5eab-497f-8521-727c672e3725", "type": "Secondary"}]}