{"id":"CVE-2021-21311","aliases":["DEBIAN-CVE-2021-21311","DLA-2580-1","EUVD-2021-0576","GHSA-x5r2-hj5c-8jx6","UBUNTU-CVE-2021-21311","USN-5271-1"],"status":"published","title":"SSRF in adminer","description":"Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. `adminer.php`) are affected. This is fixed in version 4.7.9.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.98464,"percentile":0.9992,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-918"],"published":"2021-02-11T20:42:59Z","modified":"2026-10-23T18:03:11Z","kev":{"date_added":"2025-09-29","due_date":"2025-10-20","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2025-09-29"},{"source":"kev","since":"2025-09-29"}],"exploits":[{"source":"pocgithub","id":"llhala/CVE-2021-21311","title":"llhala/CVE-2021-21311","date":"2022-02-14","url":"https://github.com/llhala/CVE-2021-21311"},{"source":"pocgithub","id":"omoknooni/CVE-2021-21311","title":"omoknooni/CVE-2021-21311","date":"2023-06-12","url":"https://github.com/omoknooni/CVE-2021-21311"},{"source":"pocgithub","id":"Sudo-WP/sudowp-adminer","title":"Sudo-WP/sudowp-adminer","date":"2026-01-24","url":"https://github.com/Sudo-WP/sudowp-adminer"},{"source":"nuclei","id":"CVE-2021-21311","title":"Adminer \u003c4.7.9 - Server-Side Request Forgery","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21311.yaml"}],"fixes":[{"ecosystem":"Packagist","package":"vrana/adminer","fixed_in":["4.7.9"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"adminer","fixed_in":["4.7.9-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"adminer","fixed_in":["4.7.9-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"adminer","fixed_in":["4.7.9-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"adminer","fixed_in":["4.2.5-3+deb9u2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"adminer","fixed_in":["4.2.1-1ubuntu1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"adminer","fixed_in":["4.6.2-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"adminer","fixed_in":["4.7.6-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"vrana/adminer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.9"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"adminer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.9-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"adminer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.9-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"adminer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.9-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"adminer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.5-3+deb9u2"}]}],"versions":["4.2.5-3","4.2.5-3+deb9u1"]},{"source":"osv","ecosystem":"Packagist","package":"vrana/adminer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.9"}]}],"versions":["v4.2.0","v4.2.1","v4.2.2","v4.2.3","v4.2.4","v4.2.5","v4.3.0","v4.3.1","v4.4.0","v4.5.0","v4.6.0","v4.6.1","v4.6.2","v4.6.3","v4.7.0","v4.7.1","v4.7.2","v4.7.3","v4.7.4","v4.7.5","v4.7.6","v4.7.7","v4.7.8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"adminer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-1ubuntu1+esm1"}]}],"versions":["4.2.1-1","4.2.1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"adminer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.2-1ubuntu0.1~esm1"}]}],"versions":["4.3.1-2","4.5.0-1","4.6.1-1","4.6.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"adminer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.6-1ubuntu0.1~esm1"}]}],"versions":["4.7.2-1","4.7.4-1","4.7.5-1","4.7.6-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"adminer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-1ubuntu1+esm1"}]}],"versions":["4.2.1-1","4.2.1-1ubuntu1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"adminer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.2-1ubuntu0.1~esm1"}]}],"versions":["4.3.1-2","4.5.0-1","4.6.1-1","4.6.2-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"adminer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.6-1ubuntu0.1~esm1"}]}],"versions":["4.7.2-1","4.7.4-1","4.7.5-1","4.7.6-1"],"bundled":3}],"products":[{"vendor":"adminer","product":"adminer"},{"vendor":"debian","product":"debian_linux"},{"vendor":"vrana","product":"adminer"}],"references":[{"url":"https://github.com/vrana/adminer/security/advisories/GHSA-x5r2-hj5c-8jx6","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/vrana/adminer/files/5957311/Adminer.SSRF.pdf","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://packagist.org/packages/vrana/adminer","tags":["x_refsource_MISC","x_transferred","Product","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/vrana/adminer/commit/ccd2374b0b12bd547417bf0dacdf153826c83351","tags":["x_refsource_MISC","x_transferred","Patch","fix","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/03/msg00002.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21311","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21311","tags":["advisory"]},{"url":"https://sourceforge.net/p/adminer/news/2021/02/adminer-479-released","tags":["web"]},{"url":"https://github.com/advisories/GHSA-x5r2-hj5c-8jx6"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-21311","tags":["advisory"]},{"url":"https://github.com/vrana/adminer","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2021-21311","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5271-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21311","tags":["report"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-35572","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-29625","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-21311","title":"SSRF in adminer","description":"Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. `adminer.php`) are affected. This is fixed in version 4.7.9.","status":"published","published":"2021-02-11T20:55:15Z","modified":"2025-10-21T23:35:27.923Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:33:00.137099Z"}],"euvd":[{"id":"EUVD-2021-0576","description":"Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. `adminer.php`) are affected. This is fixed in version 4.7.9.","status":"published","published":"2021-02-11T20:55:15Z","modified":"2025-10-21T23:35:27Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"exploited_since":"2025-09-29","updated_at":"2026-11-02T20:31:25.308373Z"}],"ghsa":[{"id":"GHSA-x5r2-hj5c-8jx6","title":"SSRF in adminer","description":"### Impact\nUsers of Adminer versions bundling all drivers (e.g. `adminer.php`) are affected.\n\n### Patches\nPatched by ccd2374b, included in version [4.7.9](https://github.com/vrana/adminer/releases/tag/v4.7.9).\n\n### Workarounds\n* Use a single driver version (e.g. `adminer-mysql.php`).\n* Protect access to Adminer also by other means, e.g. by HTTP password, IP address limiting or by OTP [plugin](https://www.adminer.org/plugins/).\n\n### References\nhttps://github.com/vrana/adminer/files/5957311/Adminer.SSRF.pdf\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Comment at ccd2374b.","status":"published","published":"2021-02-11T20:42:59Z","modified":"2025-10-22T19:05:33Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N/E:H","level":"high"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:39:02.474737Z"}],"kev":[{"id":"CVE-2021-21311","title":"Adminer Server-Side Request Forgery Vulnerability","description":"Adminer contains a server-side request forgery vulnerability that, when exploited, allows a remote attacker to obtain potentially sensitive information.","cwes":["CWE-918"],"kev":{"date_added":"2025-09-29","due_date":"2025-10-20","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:15.999436Z"}],"nvd":[{"id":"CVE-2021-21311","description":"Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. `adminer.php`) are affected. This is fixed in version 4.7.9.","status":"published","published":"2021-02-11T21:15:13.82Z","modified":"2026-06-17T03:35:16.213Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:06:50.031227Z"}],"osv":[{"id":"CVE-2021-21311","description":"Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. `adminer.php`) are affected. This is fixed in version 4.7.9.","status":"published","published":"2021-02-11T21:15:13.82Z","modified":"2026-10-20T10:53:33.505547597Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:18.004149Z"},{"id":"DEBIAN-CVE-2021-21311","description":"Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. `adminer.php`) are affected. This is fixed in version 4.7.9.","status":"published","published":"2021-02-11T21:15:13.82Z","modified":"2026-10-23T18:03:11.330448112Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"GHSA-x5r2-hj5c-8jx6","title":"SSRF in adminer","description":"### Impact\nUsers of Adminer versions bundling all drivers (e.g. `adminer.php`) are affected.\n\n### Patches\nPatched by ccd2374b, included in version [4.7.9](https://github.com/vrana/adminer/releases/tag/v4.7.9).\n\n### Workarounds\n* Use a single driver version (e.g. `adminer-mysql.php`).\n* Protect access to Adminer also by other means, e.g. by HTTP password, IP address limiting or by OTP [plugin](https://www.adminer.org/plugins/).\n\n### References\nhttps://github.com/vrana/adminer/files/5957311/Adminer.SSRF.pdf\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Comment at ccd2374b.","status":"published","published":"2021-02-11T20:42:59Z","modified":"2026-09-10T03:49:14.190623191Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N/E:H","level":"high"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:46:59.484835Z"},{"id":"UBUNTU-CVE-2021-21311","description":"Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. `adminer.php`) are affected. This is fixed in version 4.7.9.","status":"published","published":"2021-02-11T21:15:00Z","modified":"2026-02-05T04:22:48.906884Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:26.29421Z"},{"id":"DLA-2580-1","title":"adminer - security update","status":"published","published":"2021-03-03T00:00:00Z","modified":"2026-03-09T01:22:23.978574Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"USN-5271-1","title":"adminer vulnerabilities","description":"It was discovered that Adminer did not escape data in the history parameter\nof the default URI. A remote attacker could possibly use this issue to perform\ncross-site scripting (XSS) attacks. This issue only affected Ubuntu 20.04 ESM.\n(CVE-2020-35572)\n\nAdam Crosser and Brian Sizemore discovered that Adminer incorrectly handled\nredirection requests to internal servers. An unauthenticated remote attacker\ncould possibly use this to perform a server-side request forgery attack and\nexpose sensitive information. (CVE-2021-21311)\n\nIt was discovered that Adminer was incorrectly escaping data in the doc_link\nfunction. A remote attacker could possibly use this issue to perform cross-site\nscripting (XSS) attacks. This issue only affected Ubuntu 18.04 ESM and\nUbuntu 20.04 ESM. (CVE-2021-29625)\n","status":"published","published":"2022-06-03T13:18:00Z","modified":"2026-06-25T13:30:58.731969664Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}