{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "Improper Access Control in Adminer versions 1.12.0 to 4.6.2 (fixed in version 4.6.3) allows an attacker to achieve Arbitrary File Read on the remote server by requesting the Adminer to connect to a remote MySQL database."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-05-13T18:06:11", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/vrana/adminer/releases/tag/v4.6.3"}, {"tags": ["x_refsource_MISC"], "url": "https://www.adminer.org/"}, {"tags": ["x_refsource_MISC"], "url": "https://sansec.io/research/adminer-4.6.2-file-disclosure-vulnerability"}, {"tags": ["x_refsource_MISC"], "url": "https://podalirius.net/en/cves/2021-43008/"}, {"name": "[debian-lts-announce] 20220513 [SECURITY] [DLA 3002-1] adminer security update", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00012.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2021-43008", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Improper Access Control in Adminer versions 1.12.0 to 4.6.2 (fixed in version 4.6.3) allows an attacker to achieve Arbitrary File Read on the remote server by requesting the Adminer to connect to a remote MySQL database."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://github.com/vrana/adminer/releases/tag/v4.6.3", "refsource": "MISC", "url": "https://github.com/vrana/adminer/releases/tag/v4.6.3"}, {"name": "https://www.adminer.org/", "refsource": "MISC", "url": "https://www.adminer.org/"}, {"name": "https://sansec.io/research/adminer-4.6.2-file-disclosure-vulnerability", "refsource": "MISC", "url": "https://sansec.io/research/adminer-4.6.2-file-disclosure-vulnerability"}, {"name": "https://podalirius.net/en/cves/2021-43008/", "refsource": "MISC", "url": "https://podalirius.net/en/cves/2021-43008/"}, {"name": "[debian-lts-announce] 20220513 [SECURITY] [DLA 3002-1] adminer security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00012.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T03:47:13.222Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/vrana/adminer/releases/tag/v4.6.3"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.adminer.org/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://sansec.io/research/adminer-4.6.2-file-disclosure-vulnerability"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://podalirius.net/en/cves/2021-43008/"}, {"name": "[debian-lts-announce] 20220513 [SECURITY] [DLA 3002-1] adminer security update", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00012.html"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2021-43008", "datePublished": "2022-04-05T01:46:09", "dateReserved": "2021-10-25T00:00:00", "dateUpdated": "2024-08-04T03:47:13.222Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:adminer:adminer:*:*:*:*:*:*:*:*", "matchCriteriaId": "D549BB34-3EDB-4FD7-8645-7D51C39B3773", "versionEndIncluding": "4.6.2", "versionStartIncluding": "1.12.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Access Control in Adminer versions 1.12.0 to 4.6.2 (fixed in version 4.6.3) allows an attacker to achieve Arbitrary File Read on the remote server by requesting the Adminer to connect to a remote MySQL database."}, {"lang": "es", "value": "Un control de acceso inapropiado en las versiones 1.12.0 a 4.6.2 de Adminer (corregido en la versi\u00f3n 4.6.3) permite a un atacante lograr una lectura arbitraria de archivos en el servidor remoto solicitando a Adminer que sea conectado a una base de datos MySQL remota"}], "id": "CVE-2021-43008", "lastModified": "2022-09-30T13:03:53.617", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-04-05T02:15:06.887", "references": [{"source": "cve@mitre.org", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/vrana/adminer/releases/tag/v4.6.3"}, {"source": "cve@mitre.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00012.html"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://podalirius.net/en/cves/2021-43008/"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://sansec.io/research/adminer-4.6.2-file-disclosure-vulnerability"}, {"source": "cve@mitre.org", "tags": ["Product"], "url": "https://www.adminer.org/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}