VulnerabilityAnalyzed

CVE-2023-45195

Adminer and AdminerEvo are vulnerable to SSRF via database connection fields.

MEDIUM 6.9EPSS 0.41%

Does this matter?

Lower severity and a low EPSS score (0.41%). Track it; it rarely justifies an emergency change on its own.

Description

Adminer and AdminerEvo are vulnerable to SSRF via database connection fields. This could allow an unauthenticated remote attacker to enumerate or access systems the attacker would not otherwise have access to. Adminer is no longer supported, but this issue was fixed in AdminerEvo version 4.8.4.

CVSS 4.0: 6.9 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.41% probability · 35th percentile
CISA KEV: Not listed
Weakness: CWE-918
Affected: adminerevo/adminerevo
Source: 9119a7d8-5eab-497f-8521-727c672e3725

References

https://github.com/adminerevo/adminerevo/pull/102/commits/18f3167bbcbec3bc746f62db72e016aa99144efcPatch
https://github.com/adminerevo/adminerevo/pull/102/commits/18f3167bbcbec3bc746f62db72e016aa99144efcPatch

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.