CVE-2021-43008: Files or Directories Accessible to External Parties in Adminer
Summary
CVE-2021-43008: Files or Directories Accessible to External Parties in Adminer. Affects vrana/adminer versions >= 1.12.0, < 4.6.3. Fixed in 4.6.3. How to fix ↓
Also tracked for
- adminer · Debian:11
The same CVE-2021-43008 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Adminer is a database management tool that allows users to manage and interact with various database systems. It provides a user-friendly interface for executing SQL queries, managing database structures, and performing other administrative tasks. However, versions 1.12.0 to 4.6.2 of Adminer are vulnerable to an improper access control issue, which can lead to arbitrary file read on the remote server. This vulnerability has been fixed in version 4.6.3.
Vulnerability Detail
The vulnerability in Adminer arises from improper access control, allowing an attacker to exploit the software's connection to a remote MySQL database. By leveraging this vulnerability, an attacker can gain unauthorized access to files or directories on the remote server. This can potentially expose sensitive information and compromise the security of the affected system. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
How To Fix
Minimum fixed version
4.6.3
This is the first release that contains the fix.
composer require vrana/adminer:4.6.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the Adminer interface by implementing appropriate network-level controls, such as firewall rules or IP whitelisting. This can help mitigate the risk of unauthorized access to the vulnerable functionality until the software is updated to a secure version.
Conclusion
In conclusion, the vulnerability in Adminer versions 1.12.0 to 4.6.2 allows for arbitrary file read on the remote server, potentially leading to unauthorized access and exposure of sensitive information. It is crucial to update to Adminer version 4.6.3 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for vrana/adminer →
FAQ
Adminer is a database management tool that provides a user-friendly interface for managing and interacting with various database systems.
Versions 1.12.0 to 4.6.2 of Adminer are affected by this vulnerability.
This vulnerability allows an attacker to achieve arbitrary file read on the remote server, potentially exposing sensitive information and compromising the security of the affected system.
Yes, this vulnerability has been fixed in Adminer version 4.6.3.
The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
Related vulnerabilities
Recent vulnerabilities recorded for vrana/adminer.
