- Release Date: April 26, 2022
- Component Type: Third party extension. This extension is not a part of the TYPO3 default installation.
- Component: "Adminer" (t3adminer)
- Vulnerability Type: Server-side request forgery and Cross-Site Scripting
- Affected Versions: 9.6.0 and below
- Severity: Medium
- Suggested CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N/E:F/RL:O/RC:X
- References: CVE-2021-29625 and CVE-2018-7667
Problem Description
The extension bundles a vulnerable version of the 3rd party component “adminer” which is known to be vulnerable against Server-side request forgery and Cross-Site Scripting.
Solution
An updated version 9.6.1 is available from the TYPO3 extension manager, packagist and at
https://extensions.typo3.org/extension/download/t3adminer/9.6.1/zip
Users of the extension are advised to update the extension as soon as possible.
Note: In general the TYPO3 Security Team recommends to not use any extension that bundles database or file management tools on production TYPO3 websites.
Credits
Thanks to Jigal van Hemert for providing an updated version of the extension.
General Advice
Follow the recommendations that are given in the TYPO3 Security Guide. Please subscribe to the typo3-announce mailing list.