Description (CNA)
Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing Content Security Policy protections.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| vrana / adminer | affected 0 before 5.4.3; unaffected 5.4.3 |
CWE
CWE-79
References
- https://github.com/vrana/adminer/security/advisories/GHSA-h6jr-7pr6-grgj
- https://www.vulncheck.com/advisories/adminer-before-cross-site-scripting-via-mysql-version-string
ADP enrichment
No English description supplied.
No references supplied.