CVE-2021-41175: fallo de gravedad alta en pi-hole AdminLTE
Stored XSS in Client Groups Management (Authenticated)
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.3epss 0.9%
Pi-hole's Web interface (based on AdminLTE) provides a central location to manage one's Pi-hole and review the statistics generated by FTLDNS. Prior to version 5.8, cross-site scripting is possible when adding a client via the groups-clients management page. This issue was patched in version 5.8.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Productos afectados
pi-hole · AdminLTECVEs relacionadas — pi-hole AdminLTE
En el mismo producto, de las más peligrosas a las menos.
CVE-2021-32706HIGH(Authenticated) Remote Code Execution Possible in Web Interface 5.5EPSS 60.2%CVE-2022-23513MEDIUMPi-Hole/AdminLTE vulnerable due to improper access control in queryads endpointEPSS 42.3%CVE-2023-23614HIGHImproper session handling of "Remember me for 7 days" functionalityEPSS 1.0%CVE-2021-32793MEDIUMStored XSS Vulnerability in the Pi-hole WebinterfaceEPSS 0.8%CVE-2021-29448HIGHStored DOM XSS in Pi-hole Admin Web InterfaceEPSS 0.7%CVE-2022-31029MEDIUMAuthenticated XSS in Pi-hole AdminLTEEPSS 0.5%