How severe is CVE-2021-21311?

CVE-2021-21311 has a CVSS 3.1 base score of 7.2 (HIGH). EPSS estimates a 98.5% probability of exploitation in the next 30 days. It is listed in the CISA Known Exploited Vulnerabilities catalog.

CVE-2021-21311: SSRF in

CISA Known Exploited Vulnerabilities

Adminer Server-Side Request Forgery Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV

2025-09-29

Remediation due

2025-10-20

Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA notes
https://github.com/vrana/adminer/security/advisories/GHSA-x5r2-hj5c-8jx6 ; https://nvd.nist.gov/vuln/detail/CVE-2021-21311

Description

Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. `adminer.php`) are affected. This is fixed in version 4.7.9.

Severity

CVSS 3.1 · CNA7.2 HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

SSVC · CISA-ADP

Exploitationactive

Automatableyes

Technical impactpartial

Affected Products

Vendor	Product	Affected versions
vrana	adminer	>= 4.0.0, < 4.7.9

References

5 Links

Mailing lists

[debian-lts-announce] 20210302 [SECURITY] [DLA 2580-1] adminer security update

Other references

Record Details

Published

2021-02-11

Last updated

2025-10-21

Assigner (CNA)

GitHub_M

Credited to

Related Tool Categories

Tool categories that test for or protect against this vulnerability class.

CWE-918 · Server-Side Request Forgery

Application Security Tools Penetration Testing Tools

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.