PT-2022-11628 · Unknown · Phpredisadmin

Published 2022-12-19 · Updated 2024-05-17 · CVE-2021-4259

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions phpRedisAdmin versions up to 1.17.3 phpRedisAdmin versions up to 1.16.1 can be simplified to the above line as 1.17.3 includes all versions up to 1.16.1, so the final output is: phpRedisAdmin versions up to 1.17.3

Description A vulnerability was found in phpRedisAdmin. It has been classified as problematic. This affects the function authHttpDigest of the file includes/login.inc.php. The manipulation of the argument response leads to use of wrong operator in string comparison.

Recommendations For phpRedisAdmin versions up to 1.17.3, upgrade to version 1.16.2 or later to address this issue. As a temporary workaround, consider disabling the authHttpDigest function until a patch is available.

Fix

Weakness Enumeration

CWE-597

Related Identifiers

CVE-2021-4259

Affected Products

Phpredisadmin

References · 8

• https://github.com/erikdubbelboer/phpRedisAdmin/commit/31aa7661e6db6f4dffbf9a635817832a0a11c7d9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-4259 · Security Note
• https://osv.dev/vulnerability/CVE-2021-4259 · Vendor Advisory
• https://github.com/erikdubbelboer/phpRedisAdmin/releases/tag/v1.16.2 · Note
• https://t.me/cibsecurity/54854 · Telegram Post
• https://t.me/cvenotify/40612 · Telegram Post
• https://vuldb.com/?id.216267 · Note
• https://t.me/cvenotify/40807 · Telegram Post