Adminer vulnerabilities

Releases

• Ubuntu 20.04 LTS
• Ubuntu 18.04 ESM
• Ubuntu 16.04 ESM

Packages

• adminer - Web-based database administration tool

Details

It was discovered that Adminer did not escape data in the history parameter
of the default URI. A remote attacker could possibly use this issue to perform
cross-site scripting (XSS) attacks. This issue only affected Ubuntu 20.04 ESM.
(CVE-2020-35572)

Adam Crosser and Brian Sizemore discovered that Adminer incorrectly handled
redirection requests to internal servers. An unauthenticated remote attacker
could possibly use this to perform a server-side request forgery attack and
expose sensitive information. (CVE-2021-21311)

It was discovered that Adminer was incorrectly escaping data in the doc_link
function. A remote attacker could possibly use this issue to perform cross-site
scripting (XSS) attacks. This issue only affected Ubuntu 18.04 ESM and
Ubuntu 20.04 ESM. (CVE-2021-29625)