CVE-2020-35572: XSS
Impact Users of Adminer versions supporting SQL command (most versions, e.g. MySQL) using browsers not encoding URL parameters before sending to server (likely Edge, not Chrome, not Firefox) are affected.
Patches Patched by 5c395afc, included in version 4.7.9.
Workarounds Use browser which encodes URL parameters (e.g. Chrome or Firefox).
References https://sourceforge.net/p/adminer/bugs-and-features/775/
For more information If you have any questions or comments about this advisory: Comment at https://sourceforge.net/p/adminer/bugs-and-features/775/
Other sources
Adminer through 4.7.8 allows XSS via the history parameter to the default URI.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-35572?
The severity of CVE-2020-35572 is medium with a CVSS score of 6.1.
Which versions of Adminer are affected by CVE-2020-35572?
Adminer versions prior to 4.7.9 are affected by CVE-2020-35572.
How does CVE-2020-35572 impact users?
Users of Adminer versions using browsers that do not encode URL parameters before sending to the server are affected by CVE-2020-35572. This vulnerability is likely to affect users of Edge, but not Chrome or Firefox.
How can I patch CVE-2020-35572?
CVE-2020-35572 can be patched by updating to Adminer version 4.7.9 or later.
What is the Common Weakness Enumeration (CWE) for CVE-2020-35572?
The Common Weakness Enumeration (CWE) for CVE-2020-35572 is CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').