CVE-2021-32706: fallo de gravedad alta en pi-hole AdminLTE
(Authenticated) Remote Code Execution Possible in Web Interface 5.5
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
48Vexday Risk Score
Corrige pronto. Ella tiene exploit funcional público.
ssvc Attendcvss 7.6epss 60%
de la publicación al armael mismo día
Publicada en NVD4 ago
metasploit4 ago
Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web interface version 5.5.1, the `validDomainWildcard` preg_match filter allows a malicious character through that can be used to execute code, list directories, and overwrite sensitive files. The issue lies in the fact that one of the periods is not escaped, allowing any character to be used in its place. A patch for this vulnerability was released in version 5.5.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Productos afectados
pi-hole · AdminLTECVEs relacionadas — pi-hole AdminLTE
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-23513MEDIUMPi-Hole/AdminLTE vulnerable due to improper access control in queryads endpointEPSS 42.3%CVE-2023-23614HIGHImproper session handling of "Remember me for 7 days" functionalityEPSS 1.0%CVE-2021-41175HIGHStored XSS in Client Groups Management (Authenticated)EPSS 0.9%CVE-2021-32793MEDIUMStored XSS Vulnerability in the Pi-hole WebinterfaceEPSS 0.8%CVE-2021-29448HIGHStored DOM XSS in Pi-hole Admin Web InterfaceEPSS 0.7%CVE-2022-31029MEDIUMAuthenticated XSS in Pi-hole AdminLTEEPSS 0.5%