cve-2021-29625
Vulnerability from cvelistv5
Published
2021-05-19 21:35
Modified
2024-08-03 22:11
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
XSS in doc_link
References
security-advisories@github.comhttps://github.com/vrana/adminer/commit/4043092ec2c0de2258d60a99d0c5958637d051a7Patch, Third Party Advisory
security-advisories@github.comhttps://github.com/vrana/adminer/security/advisories/GHSA-2v82-5746-vwqcPatch, Third Party Advisory
security-advisories@github.comhttps://sourceforge.net/p/adminer/bugs-and-features/797/Exploit, Product, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/vrana/adminer/commit/4043092ec2c0de2258d60a99d0c5958637d051a7Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/vrana/adminer/security/advisories/GHSA-2v82-5746-vwqcPatch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://sourceforge.net/p/adminer/bugs-and-features/797/Exploit, Product, Third Party Advisory
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T22:11:06.269Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/vrana/adminer/security/advisories/GHSA-2v82-5746-vwqc"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/vrana/adminer/commit/4043092ec2c0de2258d60a99d0c5958637d051a7"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://sourceforge.net/p/adminer/bugs-and-features/797/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "adminer",
          "vendor": "vrana",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.7.8, \u003c 4.8.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Adminer is open-source database management software. A cross-site scripting vulnerability in Adminer versions 4.6.1 to 4.8.0 affects users of MySQL, MariaDB, PgSQL and SQLite. XSS is in most cases prevented by strict CSP in all modern browsers. The only exception is when Adminer is using a `pdo_` extension to communicate with the database (it is used if the native extensions are not enabled). In browsers without CSP, Adminer versions 4.6.1 to 4.8.0 are affected. The vulnerability is patched in version 4.8.1. As workarounds, one can use a browser supporting strict CSP or enable the native PHP extensions (e.g. `mysqli`) or disable displaying PHP errors (`display_errors`)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-05-19T21:35:11",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vrana/adminer/security/advisories/GHSA-2v82-5746-vwqc"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vrana/adminer/commit/4043092ec2c0de2258d60a99d0c5958637d051a7"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://sourceforge.net/p/adminer/bugs-and-features/797/"
        }
      ],
      "source": {
        "advisory": "GHSA-2v82-5746-vwqc",
        "discovery": "UNKNOWN"
      },
      "title": "XSS in doc_link",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-29625",
          "STATE": "PUBLIC",
          "TITLE": "XSS in doc_link"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "adminer",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003e= 4.7.8, \u003c 4.8.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "vrana"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Adminer is open-source database management software. A cross-site scripting vulnerability in Adminer versions 4.6.1 to 4.8.0 affects users of MySQL, MariaDB, PgSQL and SQLite. XSS is in most cases prevented by strict CSP in all modern browsers. The only exception is when Adminer is using a `pdo_` extension to communicate with the database (it is used if the native extensions are not enabled). In browsers without CSP, Adminer versions 4.6.1 to 4.8.0 are affected. The vulnerability is patched in version 4.8.1. As workarounds, one can use a browser supporting strict CSP or enable the native PHP extensions (e.g. `mysqli`) or disable displaying PHP errors (`display_errors`)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/vrana/adminer/security/advisories/GHSA-2v82-5746-vwqc",
              "refsource": "CONFIRM",
              "url": "https://github.com/vrana/adminer/security/advisories/GHSA-2v82-5746-vwqc"
            },
            {
              "name": "https://github.com/vrana/adminer/commit/4043092ec2c0de2258d60a99d0c5958637d051a7",
              "refsource": "MISC",
              "url": "https://github.com/vrana/adminer/commit/4043092ec2c0de2258d60a99d0c5958637d051a7"
            },
            {
              "name": "https://sourceforge.net/p/adminer/bugs-and-features/797/",
              "refsource": "MISC",
              "url": "https://sourceforge.net/p/adminer/bugs-and-features/797/"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-2v82-5746-vwqc",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2021-29625",
    "datePublished": "2021-05-19T21:35:11",
    "dateReserved": "2021-03-30T00:00:00",
    "dateUpdated": "2024-08-03T22:11:06.269Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-29625\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2021-05-19T22:15:07.903\",\"lastModified\":\"2024-11-21T06:01:31.290\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Adminer is open-source database management software. A cross-site scripting vulnerability in Adminer versions 4.6.1 to 4.8.0 affects users of MySQL, MariaDB, PgSQL and SQLite. XSS is in most cases prevented by strict CSP in all modern browsers. The only exception is when Adminer is using a `pdo_` extension to communicate with the database (it is used if the native extensions are not enabled). In browsers without CSP, Adminer versions 4.6.1 to 4.8.0 are affected. The vulnerability is patched in version 4.8.1. As workarounds, one can use a browser supporting strict CSP or enable the native PHP extensions (e.g. `mysqli`) or disable displaying PHP errors (`display_errors`).\"},{\"lang\":\"es\",\"value\":\"Adminer es un software de administraci\u00f3n de bases de datos de c\u00f3digo abierto.\u0026#xa0;Una vulnerabilidad de tipo cross-site scripting en Adminer versiones 4.6.1 hasta 4.8.0, afecta a los usuarios de MySQL, MariaDB, PgSQL y SQLite.\u0026#xa0;Un ataque de tipo XSS en la mayor\u00eda de los casos es impedido por un CSP estricto en todos los navegadores modernos.\u0026#xa0;La \u00fanica excepci\u00f3n es cuando Adminer est\u00e1 usando una extensi\u00f3n \\\"pdo_\\\" para comunicarse con la base de datos (se usa si las extensiones nativas no est\u00e1n habilitadas).\u0026#xa0;En los navegadores sin CSP, las versiones de Adminer 4.6.1 hasta 4.8.0 est\u00e1n afectadas.\u0026#xa0;La vulnerabilidad est\u00e1 parcheada en la versi\u00f3n 4.8.1.\u0026#xa0;Como soluciones alternativas, se puede usar un navegador que admita CSP estricto o habilitar las extensiones nativas de PHP (por ejemplo, \\\"mysqli\\\") o deshabilitar la visualizaci\u00f3n de errores de PHP (\\\"display_errors\\\")\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.6,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:P/A:N\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adminer:adminer:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.6.1\",\"versionEndExcluding\":\"4.8.1\",\"matchCriteriaId\":\"141DCC97-784C-4851-B1DC-01F41E749177\"}]}]}],\"references\":[{\"url\":\"https://github.com/vrana/adminer/commit/4043092ec2c0de2258d60a99d0c5958637d051a7\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/vrana/adminer/security/advisories/GHSA-2v82-5746-vwqc\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://sourceforge.net/p/adminer/bugs-and-features/797/\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Product\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/vrana/adminer/commit/4043092ec2c0de2258d60a99d0c5958637d051a7\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/vrana/adminer/security/advisories/GHSA-2v82-5746-vwqc\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://sourceforge.net/p/adminer/bugs-and-features/797/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Product\",\"Third Party Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.