CVE-2020-35186 describes a critical vulnerability in official Adminer Docker images prior to version 4.7.0-fastcgi, where a root user is configured with a blank password. This allows a remote attacker to gain root access to systems deploying affected Adminer Docker containers, posing a significant risk of complete compromise. With a CVSS score of 9.8 (Critical), it has a low attack complexity and no user interaction required, enabling unauthenticated remote exploitation. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), it has garnered some community discussion and media coverage, indicating awareness of the flaw.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 4.2.5-fastcgi, < 4.7.0-fastcgiCPE matchmatch criteria | cpe:2.3:a:docker:adminer:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.