{"id":"CVE-2021-43008","details":"Improper Access Control in Adminer versions 1.12.0 to 4.6.2 (fixed in version 4.6.3) allows an attacker to achieve Arbitrary File Read on the remote server by requesting the Adminer to connect to a remote MySQL database.","aliases":["GHSA-rxfq-3vpc-vv72"],"modified":"2026-08-07T11:48:58.318065674Z","published":"2022-04-05T02:15:06.887Z","database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"9.0"},{"last_affected":"9.0"}],"source":"CPE_STRING","vendor_product":"debian:debian_linux"}]},"references":[{"type":"WEB","url":"https://www.adminer.org/"},{"type":"ADVISORY","url":"https://github.com/vrana/adminer/releases/tag/v4.6.3"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2022/05/msg00012.html"},{"type":"EVIDENCE","url":"https://podalirius.net/en/cves/2021-43008/"},{"type":"EVIDENCE","url":"https://sansec.io/research/adminer-4.6.2-file-disclosure-vulnerability"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/vrana/adminer","events":[{"introduced":"0"},{"last_affected":"7cb3e768bbd34f4b01aa9a2b7fac1c7224a02b37"},{"fixed":"3d84dcf859e8fc6866febaa768c965dc5b11d3b8"}],"database_specific":{"cpe":"cpe:2.3:a:adminer:adminer:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.12.0"},{"last_affected":"4.6.2"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v4.6.2","v4.6.1","v4.6.0","v4.5.0","v4.4.0","v4.3.1","v4.3.0","v4.2.5","v4.2.4","v4.2.3","v4.2.2","v4.2.1","v4.2.0","v4.1.0","v4.0.3","v4.0.2","v4.0.1","v4.0.0","v3.7.1","v3.7.0","v3.6.4","v3.6.3","v3.6.2","v3.6.1","v3.6.0","v3.5.1","v3.5.0","v3.4.0","v3.3.4","v3.3.3","v3.3.2","v3.3.1","v3.3.0","v3.2.2","v3.2.1","v3.2.0","v3.1.0","v3.0.1","v3.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-43008.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}