197 lines
8.3 KiB
JSON
197 lines
8.3 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.1",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2023-45196",
|
||
"assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "cisa-cg",
|
||
"dateReserved": "2023-10-05T03:54:13.664Z",
|
||
"datePublished": "2024-06-24T20:48:21.534Z",
|
||
"dateUpdated": "2024-08-02T20:14:20.034Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"affected": [
|
||
{
|
||
"cpes": [
|
||
"cpe:2.3:a:adminer:adminer:0:*:*:*:*:*:*:*",
|
||
"cpe:2.3:a:adminer:adminer:*:*:*:*:*:*:*:*"
|
||
],
|
||
"defaultStatus": "unknown",
|
||
"product": "Adminer",
|
||
"vendor": "Adminer",
|
||
"versions": [
|
||
{
|
||
"lessThanOrEqual": "*",
|
||
"status": "affected",
|
||
"version": "0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThanOrEqual": "cpe:2.3:a:adminer:adminer:*:*:*:*:*:*:*:*",
|
||
"status": "affected",
|
||
"version": "cpe:2.3:a:adminer:adminer:0:*:*:*:*:*:*:*",
|
||
"versionType": "cpe"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"cpes": [
|
||
"cpe:2.3:a:adminerevo:adminerevo:4.8.2:*:*:*:*:*:*:*",
|
||
"cpe:2.3:a:adminerevo:adminerevo:4.8.4:*:*:*:*:*:*:*"
|
||
],
|
||
"defaultStatus": "unknown",
|
||
"product": "AdminerEvo",
|
||
"repo": "https://github.com/adminerevo/adminerevo",
|
||
"vendor": "AdminerEvo",
|
||
"versions": [
|
||
{
|
||
"lessThan": "4.8.4",
|
||
"status": "affected",
|
||
"version": "4.8.2",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "cpe:2.3:a:adminerevo:adminerevo:4.8.4:*:*:*:*:*:*:*",
|
||
"status": "affected",
|
||
"version": "cpe:2.3:a:adminerevo:adminerevo:0:*:*:*:*:*:*:*",
|
||
"versionType": "cpe"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"datePublic": "2024-04-07T15:37:00.000Z",
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"supportingMedia": [
|
||
{
|
||
"base64": false,
|
||
"type": "text/html",
|
||
"value": "<p></p><p></p><p>Adminer and AdminerEvo allow an unauthenticated remote attacker to cause a denial of service by connecting to an attacker-controlled service that responds with HTTP redirects. The denial of service is subject to PHP configuration limits. <span style=\"background-color: var(--wht);\">Adminer is no longer supported, but this issue was fixed in AdminerEvo version 4.8.4.</span></p><p></p><p></p>"
|
||
}
|
||
],
|
||
"value": "Adminer and AdminerEvo allow an unauthenticated remote attacker to cause a denial of service by connecting to an attacker-controlled service that responds with HTTP redirects. The denial of service is subject to PHP configuration limits. Adminer is no longer supported, but this issue was fixed in AdminerEvo version 4.8.4."
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV4_0": {
|
||
"Automatable": "YES",
|
||
"Recovery": "NOT_DEFINED",
|
||
"Safety": "NOT_DEFINED",
|
||
"attackComplexity": "LOW",
|
||
"attackRequirements": "NONE",
|
||
"attackVector": "NETWORK",
|
||
"baseScore": 6.9,
|
||
"baseSeverity": "MEDIUM",
|
||
"privilegesRequired": "NONE",
|
||
"providerUrgency": "NOT_DEFINED",
|
||
"subAvailabilityImpact": "NONE",
|
||
"subConfidentialityImpact": "NONE",
|
||
"subIntegrityImpact": "NONE",
|
||
"userInteraction": "NONE",
|
||
"valueDensity": "NOT_DEFINED",
|
||
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/AU:Y",
|
||
"version": "4.0",
|
||
"vulnAvailabilityImpact": "LOW",
|
||
"vulnConfidentialityImpact": "NONE",
|
||
"vulnIntegrityImpact": "NONE",
|
||
"vulnerabilityResponseEffort": "NOT_DEFINED"
|
||
},
|
||
"format": "CVSS",
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "GENERAL"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"cweId": "CWE-400",
|
||
"description": "CWE-400 Uncontrolled Resource Consumption",
|
||
"lang": "en",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"providerMetadata": {
|
||
"orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
|
||
"shortName": "cisa-cg",
|
||
"dateUpdated": "2024-06-24T20:48:21.534Z"
|
||
},
|
||
"references": [
|
||
{
|
||
"tags": [
|
||
"patch"
|
||
],
|
||
"url": "https://github.com/adminerevo/adminerevo/pull/102/commits/23e7cdc0a32b3739e13d19ae504be0fe215142b6"
|
||
}
|
||
],
|
||
"source": {
|
||
"discovery": "UNKNOWN"
|
||
},
|
||
"title": "Adminer and AdminerEvo denial of service via HTTP redirect",
|
||
"x_generator": {
|
||
"engine": "Vulnogram 0.2.0"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2024-06-25T13:20:08.611689Z",
|
||
"id": "CVE-2023-45196",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "yes"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2024-06-25T13:20:53.512Z"
|
||
}
|
||
},
|
||
{
|
||
"providerMetadata": {
|
||
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
||
"shortName": "CVE",
|
||
"dateUpdated": "2024-08-02T20:14:20.034Z"
|
||
},
|
||
"title": "CVE Program Container",
|
||
"references": [
|
||
{
|
||
"tags": [
|
||
"patch",
|
||
"x_transferred"
|
||
],
|
||
"url": "https://github.com/adminerevo/adminerevo/pull/102/commits/23e7cdc0a32b3739e13d19ae504be0fe215142b6"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
} |