4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
0.001 Low
EPSS
Percentile
32.9%
Users of Adminer versions supporting SQL command (most versions, e.g. MySQL) using browsers not encoding URL parameters before sending to server (likely Edge, not Chrome, not Firefox) are affected.
Patched by 5c395afc, included in version 4.7.9.
Use browser which encodes URL parameters (e.g. Chrome or Firefox).
https://sourceforge.net/p/adminer/bugs-and-features/775/
If you have any questions or comments about this advisory:
CPE | Name | Operator | Version |
---|---|---|---|
vrana/adminer | lt | 4.7.9 |
github.com/advisories/GHSA-9pgx-gcph-mpqr
github.com/vrana/adminer/commit/5c395afc098e501be3417017c6421968aac477bd
github.com/vrana/adminer/security/advisories/GHSA-9pgx-gcph-mpqr
nvd.nist.gov/vuln/detail/CVE-2020-35572
sourceforge.net/p/adminer/bugs-and-features/775/
sourceforge.net/p/adminer/news/2021/02/adminer-479-released/
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
0.001 Low
EPSS
Percentile
32.9%