CVE-2018-7667 vrana/adminer vulnerable to SSRF by connecting to privileged ports
CriticalCVSS 9.8
EPSS 5.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Adminer through 4.3.1 has SSRF via the server parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vrana/adminer(Packagist) | < 4.7.8 | 4.7.8 |
| vrana/adminer(Packagist) | = v4.2.0 | No fix listed |
| vrana/adminer(Packagist) | = v4.2.1 | No fix listed |
| vrana/adminer(Packagist) | = v4.2.2 | No fix listed |
| vrana/adminer(Packagist) | = v4.2.3 | No fix listed |
| vrana/adminer(Packagist) | = v4.2.4 | No fix listed |
| vrana/adminer(Packagist) | = v4.2.5 | No fix listed |
| vrana/adminer(Packagist) | = v4.3.0 | No fix listed |
| vrana/adminer(Packagist) | = v4.3.1 | No fix listed |
| vrana/adminer(Packagist) | = v4.4.0 | No fix listed |
| vrana/adminer(Packagist) | = v4.5.0 | No fix listed |
| vrana/adminer(Packagist) | = v4.6.0 | No fix listed |
| vrana/adminer(Packagist) | = v4.6.1 | No fix listed |
| vrana/adminer(Packagist) | = v4.6.2 | No fix listed |
| vrana/adminer(Packagist) | = v4.6.3 | No fix listed |
| vrana/adminer(Packagist) | = v4.7.0 | No fix listed |
| vrana/adminer(Packagist) | = v4.7.1 | No fix listed |
| vrana/adminer(Packagist) | = v4.7.2 | No fix listed |
| vrana/adminer(Packagist) | = v4.7.3 | No fix listed |
| vrana/adminer(Packagist) | = v4.7.4 | No fix listed |
| vrana/adminer(Packagist) | = v4.7.5 | No fix listed |
| vrana/adminer(Packagist) | = v4.7.6 | No fix listed |
| vrana/adminer(Packagist) | = v4.7.7 | No fix listed |
| debian/adminer(Debian:12) | < 4.5.0-1 | 4.5.0-1 |
| debian/adminer(Debian:14) | < 4.5.0-1 | 4.5.0-1 |
Show 2 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/adminer(Debian:13) | < 4.5.0-1 | 4.5.0-1 |
| Adminer | <= 4.3.1 | No fix listed |
References
- github.com vendor-advisory
- github.com patch
- gusralph.info
- sourceforge.net
- hyp3rlinx.altervista.org exploit third-party-advisory
- Debian Security Tracker CVE-2018-7667 vendor-advisory
- bugs.debian.org issue-tracking
- github.com
- [debian-lts-announce] 20180322 [SECURITY] [DLA 1311-1] adminer security update mailing-list third-party-advisory