CVE-2021-29625: XSS in doc_link
Adminer is open-source database management software. A cross-site scripting vulnerability in Adminer versions 4.6.1 to 4.8.0 affects users of MySQL, MariaDB, PgSQL and SQLite. XSS is in most cases prevented by strict CSP in all modern browsers. The only exception is when Adminer is using a pdo extension to communicate with the database (it is used if the native extensions are not enabled). In browsers without CSP, Adminer versions 4.6.1 to 4.8.0 are affected. The vulnerability is patched in version 4.8.1. As workarounds, one can use a browser supporting strict CSP or enable the native PHP extensions (e.g. mysqli) or disable displaying PHP errors (displayerrors).
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2021-29625?
The severity of CVE-2021-29625 is classified as medium due to its potential for cross-site scripting attacks.
How do I fix CVE-2021-29625?
To fix CVE-2021-29625, upgrade Adminer to version 4.8.1 or later.
Which versions of Adminer are affected by CVE-2021-29625?
CVE-2021-29625 affects Adminer versions 4.6.1 to 4.8.0.
What databases are impacted by CVE-2021-29625?
CVE-2021-29625 impacts users of MySQL, MariaDB, PgSQL, and SQLite.
Is cross-site scripting prevented in all browsers for CVE-2021-29625?
Most modern browsers prevent the cross-site scripting issue in CVE-2021-29625 by implementing strict Content Security Policy.