Critical File Disclosure Vulnerability in Adminer Package
Summary
GHSA-97h7-mf38-g9mf: Adminer file disclosure vulnerability. Affects vrana/adminer versions >= 4.3.1, < 4.6.3. Fixed in 4.6.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Adminer is a popular database management tool written in PHP. It provides a user-friendly interface for managing various database systems, allowing users to perform operations such as querying, editing, and managing database structures. The package is widely used due to its simplicity and lightweight nature. However, versions up to 4.6.2 are vulnerable to a file disclosure issue that could expose sensitive information.
Vulnerability Detail
The file disclosure vulnerability in Adminer arises from improper handling of file paths, allowing unauthorized users to access sensitive files on the server. This issue can lead to the exposure of configuration files, database credentials, and other sensitive data, potentially compromising the security of the entire application. The vulnerability is classified under CWE-200, indicating a risk of information exposure. The CVSS score for this vulnerability is 7.5, reflecting its high severity.
How To Fix
Minimum fixed version
4.6.3
This is the first release that contains the fix.
composer require vrana/adminer:4.6.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider restricting access to the Adminer script by implementing server-level restrictions or using a firewall to limit access to trusted IP addresses only. This can help mitigate the risk of unauthorized access until the package is updated.
Conclusion
The Adminer file disclosure vulnerability poses a significant risk to users of versions up to 4.6.2. It is crucial to update to version 4.6.3 or later to mitigate this risk. Users should also consider implementing workarounds to restrict access until they can apply the necessary updates.
See every vulnerability recorded for vrana/adminer →
FAQ
The vulnerability allows unauthorized access to sensitive files on the server due to improper file path handling in Adminer.
Adminer versions up to 4.6.2 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Implement server-level restrictions to limit access to the Adminer script until you can update to the patched version.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for vrana/adminer.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
