CVE-2021-43008

Improper Access Control in Adminer versions 1.12.0 to 4.6.2 (fixed in version 4.6.3) allows an attacker to achieve Arbitrary File Read on the remote server by requesting the Adminer to connect to a remote MySQL database.

Published: Apr 5, 2022
Updated: May 9, 2024
CVE: CVE-2021-43008
GHSA: GHSA-rxfq-3vpc-vv72
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2:

Severity: Medium
Score: 5
AV:N/AC:L/Au:N/C:P/I:N/A:N

CWEs:

CWE-552

Affected Software
References

Software	From	Fixed in
adminer / adminer	1.12.0	4.6.2.x
debian / debian_linux	9.0	9.0.x
vrana / adminer	1.12.0	4.6.3

https://github.com/vrana/adminer/releases/tag/v4.6.3
https://lists.debian.org/debian-lts-announce/2022/05/msg00012.html
https://podalirius.net/en/cves/2021-43008/
https://sansec.io/research/adminer-4.6.2-file-disclosure-vulnerability
https://www.adminer.org/

Vulnerability Database

CVE-2021-43008