CVE-2021-4259 : A vulnerability was found in phpRedisAdmin up to 1.16.1. It has been classified

A vulnerability was found in phpRedisAdmin up to 1.16.1. It has been classified as problematic. This affects the function authHttpDigest of the file includes/login.inc.php. The manipulation of the argument response leads to use of wrong operator in string comparison. Upgrading to version 1.16.2 is able to address this issue. The name of the patch is 31aa7661e6db6f4dffbf9a635817832a0a11c7d9. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216267.

Published 2022-12-19 14:15:10

Updated 2024-05-17 02:03:30

Source VulDB

View at NVD, CVE.org

Products affected by CVE-2021-4259

Phpredisadmin Project » Phpredisadmin
Versions before (<) 1.16.2
cpe:2.3:a:phpredisadmin_project:phpredisadmin:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2021-4259

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 18 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-4259

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.0	MEDIUM	CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L	1.6	3.4	VulDB
Attack Vector: Adjacent Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: Low Availability: Low
5.0	MEDIUM	CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L	1.6	3.4	VulDB	2024-02-29
Attack Vector: Adjacent Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: Low Availability: Low
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2021-4259

CWE-597 Use of Wrong Operator in String Comparison

The product uses the wrong operator when comparing a string, such as using "==" when the .equals() method should be used instead.

Assigned by: cna@vuldb.com (Primary)

References for CVE-2021-4259

https://github.com/erikdubbelboer/phpRedisAdmin/releases/tag/v1.16.2

Release v1.16.2 · erikdubbelboer/phpRedisAdmin · GitHub
Release Notes;Third Party Advisory
https://github.com/erikdubbelboer/phpRedisAdmin/commit/31aa7661e6db6f4dffbf9a635817832a0a11c7d9

Fix magic hash attack · erikdubbelboer/phpRedisAdmin@31aa766 · GitHub
Patch;Third Party Advisory
https://vuldb.com/?id.216267

CVE-2021-4259 | phpRedisAdmin login.inc.php authHttpDigest wrong operator in string comparison
Permissions Required;Third Party Advisory;VDB Entry

Jump to

Vulnerability Details : CVE-2021-4259

Products affected by CVE-2021-4259

Exploit prediction scoring system (EPSS) score for CVE-2021-4259

CVSS scores for CVE-2021-4259

CWE ids for CVE-2021-4259

References for CVE-2021-4259