Threats tagged 'ghsa-c9jj-9w3r-2hj8'

Adminer versions from 0 up to but not including 6.0.2 contain a pre-authentication Server-Side Request Forgery (SSRF) vulnerability in the optional Elasticsearch driver. This flaw allows an unauthenticated attacker to cause the server to make HTTP GET requests to arbitrary internal or external hosts by submitting crafted authentication parameters. The vulnerability enables internal network reconnaissance and service fingerprinting via error messages displayed on the login page. Exploitation requires the Elasticsearch driver to be explicitly enabled and PHP's allow_url_fopen setting to be active. The issue is fixed in Adminer version 6.0.2.