high7.5
CVE-2021-43008
Files or Directories Accessible to External Parties in Adminer
Impact
Improper Access Control in Adminer versions 1.12.0 to 4.6.2 (fixed in version 4.6.3) allows an attacker to achieve Arbitrary File Read on the remote server by requesting the Adminer to connect to a remote MySQL database.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | vrana/adminer | >= 1.12.0, < 4.6.3 | 4.6.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Adminer | Adminer | from 1.12.0 through 4.6.2 |
| Debian | Debian Linux | Version 9.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/vrana/adminer/releases/tag/v4.6.3
- https://lists.debian.org/debian-lts-announce/2022/05/msg00012.html
- https://podalirius.net/en/cves/2021-43008/
- https://sansec.io/research/adminer-4.6.2-file-disclosure-vulnerability
- https://www.adminer.org/
- https://github.com/advisories/GHSA-rxfq-3vpc-vv72
- https://nvd.nist.gov/vuln/detail/CVE-2021-43008