TYPO3-EXT-SA-2022-008: Multiple vulnerabilities in extension "Adminer" (t3adminer)

Categories: Development, Security Created by Torben Hansen
It has been discovered that the extension "Adminer" (t3adminer) is susceptible to Server-side request forgery and Cross-Site Scripting.
  • Release Date: April 26, 2022
  • Component Type: Third party extension. This extension is not a part of the TYPO3 default installation.
  • Component: "Adminer" (t3adminer)
  • Vulnerability Type: Server-side request forgery and Cross-Site Scripting
  • Affected Versions: 9.6.0 and below
  • Severity: Medium
  • Suggested CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N/E:F/RL:O/RC:X
  • References: CVE-2021-29625 and CVE-2018-7667

Problem Description

The extension bundles a vulnerable version of the 3rd party component “adminer” which is known to be vulnerable against Server-side request forgery and Cross-Site Scripting.  

Solution

An updated version 9.6.1 is available from the TYPO3 extension manager, packagist and at 
https://extensions.typo3.org/extension/download/t3adminer/9.6.1/zip
Users of the extension are advised to update the extension as soon as possible.

Note: In general the TYPO3 Security Team recommends to not use any extension that bundles database or file management tools on production TYPO3 websites.

Credits

Thanks to Jigal van Hemert  for providing an updated version of the extension.

General Advice

Follow the recommendations that are given in the TYPO3 Security Guide. Please subscribe to the typo3-announce mailing list.