{"id":"CVE-2021-43008","aliases":["DEBIAN-CVE-2021-43008","DLA-3002-1","EUVD-2022-1830","GHSA-rxfq-3vpc-vv72","UBUNTU-CVE-2021-43008"],"status":"published","title":"Files or Directories Accessible to External Parties in Adminer","description":"Improper Access Control in Adminer versions 1.12.0 to 4.6.2 (fixed in version 4.6.3) allows an attacker to achieve Arbitrary File Read on the remote server by requesting the Adminer to connect to a remote MySQL database.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.13641,"percentile":0.96529,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-552"],"published":"2022-04-05T01:46:09Z","modified":"2026-10-23T18:04:00Z","exploits":[{"source":"pocgithub","id":"Bamolitho/adminer_CVE-2021-43008","title":"Bamolitho/adminer_CVE-2021-43008","date":"2025-11-27","url":"https://github.com/Bamolitho/adminer_CVE-2021-43008"},{"source":"pocgithub","id":"DaturaSaturated/Adminer-CVE-2021-43008","title":"DaturaSaturated/Adminer-CVE-2021-43008","date":"2025-11-19","url":"https://github.com/DaturaSaturated/Adminer-CVE-2021-43008"},{"source":"pocgithub","id":"p0dalirius/CVE-2021-43008-AdminerRead","title":"p0dalirius/CVE-2021-43008-AdminerRead","date":"2021-12-13","url":"https://github.com/p0dalirius/CVE-2021-43008-AdminerRead"}],"fixes":[{"ecosystem":"Packagist","package":"vrana/adminer","fixed_in":["4.6.3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"adminer","fixed_in":["4.6.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"adminer","fixed_in":["4.6.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"adminer","fixed_in":["4.6.3-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"adminer","fixed_in":["4.2.5-3+deb9u3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"vrana/adminer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"4.6.3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"adminer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"adminer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"adminer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.3-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"adminer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.5-3+deb9u3"}]}],"versions":["4.2.5-3","4.2.5-3+deb9u1","4.2.5-3+deb9u2"]},{"source":"osv","ecosystem":"Packagist","package":"vrana/adminer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"4.6.3"}]}],"versions":["v4.2.0","v4.2.1","v4.2.2","v4.2.3","v4.2.4","v4.2.5","v4.3.0","v4.3.1","v4.4.0","v4.5.0","v4.6.0","v4.6.1","v4.6.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"adminer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.1-1","4.2.1-1ubuntu1","4.2.1-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"adminer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.1-2","4.5.0-1","4.6.1-1","4.6.2-1","4.6.2-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"adminer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.7.2-1","4.7.4-1","4.7.5-1","4.7.6-1","4.7.6-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"adminer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.7.9-2","4.8.1-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"adminer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.1-1","4.8.1-1ubuntu1","4.8.1-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"adminer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.1-4","5.2.1+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"adminer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.1+dfsg-1","5.4.2+dfsg-1","5.4.4+dfsg-1","6.0.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"adminer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2.1+dfsg-1","5.3.0+dfsg-1","5.4.0+dfsg-1","5.4.1+dfsg-1"]}],"products":[{"vendor":"adminer","product":"adminer"},{"vendor":"debian","product":"debian_linux"}],"references":[{"url":"https://github.com/vrana/adminer/releases/tag/v4.6.3","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web","report"]},{"url":"https://www.adminer.org/","tags":["x_refsource_MISC","x_transferred","Product","web","report"]},{"url":"https://sansec.io/research/adminer-4.6.2-file-disclosure-vulnerability","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://podalirius.net/en/cves/2021-43008/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/05/msg00012.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-43008","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rxfq-3vpc-vv72"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-43008","tags":["advisory"]},{"url":"https://github.com/vrana/adminer","tags":["package"]},{"url":"https://podalirius.net/en/cves/2021-43008","tags":["web"]},{"url":"https://www.adminer.org","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-43008","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-43008","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-43008","description":"Improper Access Control in Adminer versions 1.12.0 to 4.6.2 (fixed in version 4.6.3) allows an attacker to achieve Arbitrary File Read on the remote server by requesting the Adminer to connect to a remote MySQL database.","status":"published","published":"2022-04-05T01:46:09Z","modified":"2024-08-04T03:47:13.222Z","updated_at":"2026-11-02T14:32:56.689433Z"}],"euvd":[{"id":"EUVD-2022-1830","description":"Improper Access Control in Adminer versions 1.12.0 to 4.6.2 (fixed in version 4.6.3) allows an attacker to achieve Arbitrary File Read on the remote server by requesting the Adminer to connect to a remote MySQL database.","status":"published","published":"2022-04-05T01:46:09Z","modified":"2024-08-04T03:47:13Z","updated_at":"2026-11-03T03:24:14.796505Z"}],"ghsa":[{"id":"GHSA-rxfq-3vpc-vv72","title":"Files or Directories Accessible to External Parties in Adminer","description":"Improper Access Control in Adminer versions 1.12.0 to 4.6.2 (fixed in version 4.6.3) allows an attacker to achieve Arbitrary File Read on the remote server by requesting the Adminer to connect to a remote MySQL database.","status":"published","published":"2022-04-06T00:01:33Z","modified":"2023-01-27T05:01:20Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-552"],"updated_at":"2026-11-02T14:36:16.28305Z"}],"nvd":[{"id":"CVE-2021-43008","description":"Improper Access Control in Adminer versions 1.12.0 to 4.6.2 (fixed in version 4.6.3) allows an attacker to achieve Arbitrary File Read on the remote server by requesting the Adminer to connect to a remote MySQL database.","status":"published","published":"2022-04-05T02:15:06.887Z","modified":"2026-06-17T04:10:20.47Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:07:05.581807Z"}],"osv":[{"id":"CVE-2021-43008","description":"Improper Access Control in Adminer versions 1.12.0 to 4.6.2 (fixed in version 4.6.3) allows an attacker to achieve Arbitrary File Read on the remote server by requesting the Adminer to connect to a remote MySQL database.","status":"published","published":"2022-04-05T02:15:06.887Z","modified":"2026-10-20T10:54:06.99725006Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:21.557945Z"},{"id":"DEBIAN-CVE-2021-43008","description":"Improper Access Control in Adminer versions 1.12.0 to 4.6.2 (fixed in version 4.6.3) allows an attacker to achieve Arbitrary File Read on the remote server by requesting the Adminer to connect to a remote MySQL database.","status":"published","published":"2022-04-05T02:15:06.887Z","modified":"2026-10-23T18:04:00.408938437Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:35.799676Z"},{"id":"GHSA-rxfq-3vpc-vv72","title":"Files or Directories Accessible to External Parties in Adminer","description":"Improper Access Control in Adminer versions 1.12.0 to 4.6.2 (fixed in version 4.6.3) allows an attacker to achieve Arbitrary File Read on the remote server by requesting the Adminer to connect to a remote MySQL database.","status":"published","published":"2022-04-06T00:01:33Z","modified":"2024-02-20T05:34:06.191209Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-552"],"updated_at":"2026-11-02T15:46:56.639206Z"},{"id":"UBUNTU-CVE-2021-43008","description":"Improper Access Control in Adminer versions 1.12.0 to 4.6.2 (fixed in version 4.6.3) allows an attacker to achieve Arbitrary File Read on the remote server by requesting the Adminer to connect to a remote MySQL database.","status":"published","published":"2022-04-05T02:15:00Z","modified":"2026-10-17T12:56:15.735161401Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:29.220315Z"},{"id":"DLA-3002-1","title":"adminer - security update","status":"published","published":"2022-05-13T00:00:00Z","modified":"2026-03-09T01:20:51.226143Z","updated_at":"2026-11-02T15:46:11.189256Z"}]}}