CVE-2023-45196: Adminer and AdminerEvo denial of service via HTTP redirect

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-06-24 · updated 2026-06-17
Weakness: CWE-400

Description

Adminer and AdminerEvo allow an unauthenticated remote attacker to cause a denial of service by connecting to an attacker-controlled service that responds with HTTP redirects. The denial of service is subject to PHP configuration limits. Adminer is no longer supported, but this issue was fixed in AdminerEvo version 4.8.4.

Affected products

AdminerEvo: before 4.8.4 — fixed in 4.8.4

How to fix

Upgrade to a fixed version: AdminerEvo 4.8.4. Check the vendor advisory for mitigations.

References

https://github.com/adminerevo/adminerevo/pull/102/commits/23e7cdc0a32b3739e13d19ae504be0fe215142b6
https://github.com/adminerevo/adminerevo/pull/102/commits/23e7cdc0a32b3739e13d19ae504be0fe215142b6

Get alerted when CVE-2023-45196 or the next vulnerability affects your stack