Adminer · Adminer
CVE-2021-21311
SSRF in adminer
What it is
Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. `adminer.php`) are affected. This is fixed in version 4.7.9.
CISA: Adminer contains a server-side request forgery vulnerability that, when exploited, allows a remote attacker to obtain potentially sensitive information.
What to do
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: October 20, 2025
- Added to the CISA list
- September 29, 2025
- Published
- February 11, 2021
- Severity
- High 7.2 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 98% in the top 0.1% of all known vulnerabilities
- Weakness
- CWE-918
- More details
- NVD · CVE.org · CISA
All references (5)
- https://github.com/vrana/adminer/security/advisories/GHSA-x5r2-hj5c-8jx6
- https://github.com/vrana/adminer/files/5957311/Adminer.SSRF.pdf
- https://packagist.org/packages/vrana/adminer
- https://github.com/vrana/adminer/commit/ccd2374b0b12bd547417bf0dacdf153826c83351
- https://lists.debian.org/debian-lts-announce/2021/03/msg00002.html
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.