Detections
Analytics

SCA: security update for vrana/adminer (GHSA-2v82-5746-vwqc)

medium Tenable Cloud Security Plugin ID 433913

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Adminer is open-source database management software. A cross-site scripting vulnerability in Adminer
 versions 4.6.1 to 4.8.0 affects users of MySQL, MariaDB, PgSQL and SQLite. XSS is in most cases prevented
 by strict CSP in all modern browsers. The only exception is when Adminer is using a `pdo_` extension to
 communicate with the database (it is used if the native extensions are not enabled). In browsers without
 CSP, Adminer versions 4.6.1 to 4.8.0 are affected. The vulnerability is patched in version 4.8.1. As
 workarounds, one can use a browser supporting strict CSP or enable the native PHP extensions (e.g.
 `mysqli`) or disable displaying PHP errors (`display_errors`). (CVE-2021-29625)

See Also

https://github.com/advisories/GHSA-2v82-5746-vwqc

Plugin Details

Severity: Medium

ID: 433913

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 8/19/2025

Updated: 8/19/2025

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 8.67

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.4

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2021-29625

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 3/18/2022

Vulnerability Publication Date: 5/19/2021

Reference Information

CVE: CVE-2021-29625

cwe: CWE-79