Adminer and AdminerEvo Multiple Vulnerabilities
Adminer and AdminerEvo contain multiple vulnerabilities. Successful exploitation of these vulnerabilities could allow a remote, unauthenticated attacker to deny service, enumerate and access systems indirectly, upload arbitrary files, and execute arbitrary code. Adminer is no longer maintained. All of these vulnerabilities are fixed in AdminerEvo 4.8.4.
describes (3)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-45195US | medium5.3 | — | ||
Adminer and AdminerEvo are vulnerable to SSRF via database connection fields. This could allow an unauthenticated remote attacker to enumerate or access systems the attacker would… | ||||
| CVE-2023-45196US | high7.5 | — | ||
Adminer and AdminerEvo allow an unauthenticated remote attacker to cause a denial of service by connecting to an attacker-controlled service that responds with HTTP redirects. The… | ||||
| CVE-2023-45197US | critical9.8 | — | ||
The file upload plugin in Adminer and AdminerEvo allows an attacker to upload a file with a table name of “..” to the root of the Adminer directory. The attacker can effectively gu… | ||||
references
External citations — patches, advisories, analysis.
remediations (6)
- No fix availableAdminer
Adminer is no longer maintained. Fixed in AdminerEvo 4.8.4.
- No fix availableAdminer
Adminer is no longer maintained. Fixed in AdminerEvo 4.8.4.
- No fix availableAdminer
Adminer is no longer supported. Fixed in AdminerEvo 4.8.3.
- FixedAdminerEvo
Fixed in AdminerEvo 4.8.3
https://github.com/adminerevo/adminerevo/releases/tag/v4.8.3 - FixedAdminerEvo
Fixed in AdminerEvo 4.8.4.
https://github.com/adminerevo/adminerevo/releases/tag/v4.8.4 - FixedAdminerEvo
Fixed in AdminerEvo 4.8.4.
https://github.com/adminerevo/adminerevo/releases/tag/v4.8.4
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan