197 lines
8.2 KiB
JSON
197 lines
8.2 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.1",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2023-45195",
|
||
"assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "cisa-cg",
|
||
"dateReserved": "2023-10-05T03:54:13.664Z",
|
||
"datePublished": "2024-06-24T21:06:09.735Z",
|
||
"dateUpdated": "2024-08-02T20:14:19.950Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"affected": [
|
||
{
|
||
"cpes": [
|
||
"cpe:2.3:a:adminer:adminer:0:*:*:*:*:*:*:*",
|
||
"cpe:2.3:a:adminer:adminer:*:*:*:*:*:*:*:*"
|
||
],
|
||
"defaultStatus": "unknown",
|
||
"product": "Adminer",
|
||
"vendor": "Adminer",
|
||
"versions": [
|
||
{
|
||
"lessThanOrEqual": "*",
|
||
"status": "affected",
|
||
"version": "0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThanOrEqual": "cpe:2.3:a:adminer:adminer:*:*:*:*:*:*:*:*",
|
||
"status": "affected",
|
||
"version": "cpe:2.3:a:adminer:adminer:0:*:*:*:*:*:*:*",
|
||
"versionType": "cpe"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"cpes": [
|
||
"cpe:2.3:a:adminerevo:adminerevo:4.8.2:*:*:*:*:*:*:*",
|
||
"cpe:2.3:a:adminerevo:adminerevo:4.8.4:*:*:*:*:*:*:*"
|
||
],
|
||
"defaultStatus": "unknown",
|
||
"product": "AdminerEvo",
|
||
"repo": "https://github.com/adminerevo/adminerevo",
|
||
"vendor": "AdminerEvo",
|
||
"versions": [
|
||
{
|
||
"lessThan": "4.8.4",
|
||
"status": "affected",
|
||
"version": "4.8.2",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "cpe:2.3:a:adminerevo:adminerevo:4.8.4:*:*:*:*:*:*:*",
|
||
"status": "affected",
|
||
"version": "cpe:2.3:a:adminerevo:adminerevo:0:*:*:*:*:*:*:*",
|
||
"versionType": "cpe"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"datePublic": "2024-04-07T15:37:00.000Z",
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"supportingMedia": [
|
||
{
|
||
"base64": false,
|
||
"type": "text/html",
|
||
"value": "<p>Adminer and AdminerEvo are vulnerable to SSRF via database connection fields. This could allow an unauthenticated remote attacker to enumerate or access systems the attacker would not otherwise have access to. <span style=\"background-color: var(--wht);\">Adminer is no longer supported, but this issue was fixed in AdminerEvo version 4.8.4.</span></p><p></p>"
|
||
}
|
||
],
|
||
"value": "Adminer and AdminerEvo are vulnerable to SSRF via database connection fields. This could allow an unauthenticated remote attacker to enumerate or access systems the attacker would not otherwise have access to. Adminer is no longer supported, but this issue was fixed in AdminerEvo version 4.8.4."
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV4_0": {
|
||
"Automatable": "YES",
|
||
"Recovery": "NOT_DEFINED",
|
||
"Safety": "NOT_DEFINED",
|
||
"attackComplexity": "LOW",
|
||
"attackRequirements": "NONE",
|
||
"attackVector": "NETWORK",
|
||
"baseScore": 6.9,
|
||
"baseSeverity": "MEDIUM",
|
||
"privilegesRequired": "NONE",
|
||
"providerUrgency": "NOT_DEFINED",
|
||
"subAvailabilityImpact": "NONE",
|
||
"subConfidentialityImpact": "LOW",
|
||
"subIntegrityImpact": "NONE",
|
||
"userInteraction": "NONE",
|
||
"valueDensity": "NOT_DEFINED",
|
||
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/AU:Y",
|
||
"version": "4.0",
|
||
"vulnAvailabilityImpact": "NONE",
|
||
"vulnConfidentialityImpact": "NONE",
|
||
"vulnIntegrityImpact": "NONE",
|
||
"vulnerabilityResponseEffort": "NOT_DEFINED"
|
||
},
|
||
"format": "CVSS",
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "GENERAL"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"cweId": "CWE-918",
|
||
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
|
||
"lang": "en",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"providerMetadata": {
|
||
"orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
|
||
"shortName": "cisa-cg",
|
||
"dateUpdated": "2024-06-24T21:06:09.735Z"
|
||
},
|
||
"references": [
|
||
{
|
||
"tags": [
|
||
"patch"
|
||
],
|
||
"url": "https://github.com/adminerevo/adminerevo/pull/102/commits/18f3167bbcbec3bc746f62db72e016aa99144efc"
|
||
}
|
||
],
|
||
"source": {
|
||
"discovery": "UNKNOWN"
|
||
},
|
||
"title": "Adminer and AdminerEvo SSRF",
|
||
"x_generator": {
|
||
"engine": "Vulnogram 0.2.0"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2024-06-25T14:34:53.587598Z",
|
||
"id": "CVE-2023-45195",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "yes"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2024-06-25T14:35:33.373Z"
|
||
}
|
||
},
|
||
{
|
||
"providerMetadata": {
|
||
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
||
"shortName": "CVE",
|
||
"dateUpdated": "2024-08-02T20:14:19.950Z"
|
||
},
|
||
"title": "CVE Program Container",
|
||
"references": [
|
||
{
|
||
"tags": [
|
||
"patch",
|
||
"x_transferred"
|
||
],
|
||
"url": "https://github.com/adminerevo/adminerevo/pull/102/commits/18f3167bbcbec3bc746f62db72e016aa99144efc"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
} |