Assessment
Why it matters
CISA lists this vulnerability as known to be exploited; exploitation is confirmed; EPSS is 90.5%; technical severity is CVSS 7.2.
Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. `adminer.php`) are affected. This is fixed in version 4.7.9.
Who should care
- Teams operating Adminer, Debian Linux
- Vulnerability and exposure management teams
- Security operations teams monitoring exploitation activity
Response plan
What I would do
- Confirm whether Adminer, Debian Linux is present in the environment.
- Identify affected versions and establish whether vulnerable services are exposed or reachable.
- GitHub Security patch Ccd2374b0b12bd547417bf0dacdf153826c83351
- Review relevant security telemetry for evidence of attempted or successful exploitation.
- Document the remediation decision and track it to verified completion.
Treatment intelligence
Remediation intelligence
Vendor sources are listed before government and third-party guidance. Confirm product applicability and change prerequisites before deployment.
Verification noteAutomated link verification has not completed for this guidance yet.
Patch
Technical details
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- CWE
- CWE-918
- Affected versions
- Adminer Adminer (Start Including 4.0.0, End Excluding 4.7.9); Debian Debian Linux (Version 9.0)
- Fixed versions
- Adminer Adminer (Fixed from 4.7.9)
- Published
- 11 February 2021
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
Signal timeline
- CVE published
- Added to CISA KEV
- Latest EPSS score: 90.5%
- Signal calculated at 81