Adminer · Adminer
CVE-2021-21311
SSRF in adminer
무엇인가
Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. `adminer.php`) are affected. This is fixed in version 4.7.9.
CISA: Adminer contains a server-side request forgery vulnerability that, when exploited, allows a remote attacker to obtain potentially sensitive information.
할 일
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
미국 연방 기관 조치 기한: 2025년 10월 20일
- CISA 목록에 추가됨
- 2025년 9월 29일
- 게시됨
- 2021년 2월 11일
- 심각도
- 높음 7.2 CVSS 3.1
- 향후 30일 내 공격 가능성(EPSS)
- 98% 알려진 모든 취약점 중 상위 0.1%
- 약점 유형
- CWE-918
- 자세히
- NVD · CVE.org · CISA
모든 참고 자료(5)
- https://github.com/vrana/adminer/security/advisories/GHSA-x5r2-hj5c-8jx6
- https://github.com/vrana/adminer/files/5957311/Adminer.SSRF.pdf
- https://packagist.org/packages/vrana/adminer
- https://github.com/vrana/adminer/commit/ccd2374b0b12bd547417bf0dacdf153826c83351
- https://lists.debian.org/debian-lts-announce/2021/03/msg00002.html
출처: Known Exploited Vulnerabilities(CISA, 퍼블릭 도메인), CVE records(cve.org), EPSS(FIRST). 공격 가능성은 누군가 향후 30일 안에 이 결함을 악용하려 할 확률에 대한 EPSS 추정치입니다.