Files or Directories Accessible to External Parties in Adminer

HIGH 7.5CVE-2021-43008 · GHSA-rxfq-3vpc-vv72 · Published 05/04/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
vrana/adminer Packagist	`≥ 1.12.0, < 4.6.3`	`4.6.3`
adminer adminer	`≥ 1.12.0, ≤ 4.6.2`	No fix yet

Description

Improper Access Control in Adminer versions 1.12.0 to 4.6.2 (fixed in version 4.6.3) allows an attacker to achieve Arbitrary File Read on the remote server by requesting the Adminer to connect to a remote MySQL database.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2021-43008 · ADVISORY
vrana/adminer · PACKAGE
vrana/adminer release v4.6.3 · WEB
lists.debian.org/debian-lts-announce/2022/05/msg00012.html · WEB
podalirius.net/en/cves/2021-43008 · WEB
sansec.io/research/adminer-4.6.2-file-disclosure-vulnerability · WEB
adminer.org · WEB
podalirius.net/en/cves/2021-43008 · Exploit
adminer.org · Product

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free