CVE-2021-3850: adodb_project adodb
CVSS: 9.1v3.0CriticalModified
AliasesMGASA-2022-0056UBUNTU-CVE-2021-3850DEBIAN-CVE-2021-3850DLA-2912-1DSA-5101-1
Published 25-01-2022Last modified 03-08-2024
Vulnerability summary
CVE-2021-3850 is a critical (CVSS 9.1) vulnerability in adodb_project adodb. EPSS estimates a 2.17% chance of exploitation in the next 30 days, higher than 82% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
9.1/10
010
Critical · v3.0 (CVE.org)EPSS score
2.17%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 25-01-2022PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
Authentication Bypass by Primary Weakness in GitHub repository adodb/adodb prior to 5.20.21.
CVSS metrics
7 scores · 4 sources · 3 versionsCritical 9.1Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NSourcesAll 3 agree
- OSV · DebianEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- NVDNIST9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Critical 9.1Preferred score · CVE.org (CNA)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated9.1CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- NVDNIST9.1CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Medium 6.4Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:P/A:NSourcesSingle source
EPSS trend
Probability
2.17%
Chance of exploitation in the next 30 days
Percentile
82%
Versus all other CVEs
30-day change
0.00 pp
From 2.17% on 20-09-2026
20-09-202620-10-2026
EPSS score2.17%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (huntr.dev)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-305Authentication Bypass by Primary WeaknessThe authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Affected systems
Debian2 products
- libphp-adodb< 5.21.4-1 | < 5.20.14-1+deb10u1 | < 5.20.19-1+deb11u1 | < 5.20.9-1+deb9u1
- debian_linuxEOL9.0
Adodb1 product
- adodb/adodb≥ unspecified, < 5.20.21
Adodb_project1 product
- adodb≤ 5.20.21
Mageia1 product
- php-adodb< 5.20.21-1.mga8
Ubuntu1 product
- libphp-adodb< 5.20.3-1ubuntu1+esm1 | < 5.20.9-1ubuntu0.1~esm1 | < 5.20.16-1ubuntu0.1~esm1 | < 5.20.19-1ubuntu0.1
5 vendors · 6 products
References
12 links- huntr.dev/bounties/bdf5f216-4499-4225-a737-b28bc6f5801cX Refsource CONFIRMREPORTExploitIssue TrackingPatchThird Party Advisory
- github.com/adodb/adodb/commit/952de6c4273d9b1e91c2b838044f8c2111150c29X Refsource MISCREPORTPatchThird Party Advisory
lists.debian.org/debian-lts-announce/2022/02/msg00006.htmlMailing ListX Refsource MLISTThird Party Advisory