Skip to main content Skip to page footer

It has been discovered that the extension "Adminer" (t3adminer) is susceptible to Server-side request forgery and Cross-Site Scripting.

Problem Description

The extension bundles a vulnerable version of the 3rd party component “adminer” which is known to be vulnerable against Server-side request forgery and Cross-Site Scripting.  

Solution

An updated version 9.6.1 is available from the TYPO3 extension manager, packagist and at 

https://extensions.typo3.org/extension/download/t3adminer/9.6.1/zip

Users of the extension are advised to update the extension as soon as possible.

Note: In general the TYPO3 Security Team recommends to not use any extension that bundles database or file management tools on production TYPO3 websites.

Credits

Thanks to Jigal van Hemert  for providing an updated version of the extension.

General Advice

Follow the recommendations that are given in the TYPO3 Security Guide. Please subscribe to the typo3-announce mailing list.