CVE-2021-29448highCWE-79

CVE-2021-29448: falha de alta gravidade em pi-hole AdminLTE

Stored DOM XSS in Pi-hole Admin Web Interface

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar AdminLTE

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.6epss 0.7%
Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. The Stored XSS exists in the Pi-hole Admin portal, which can be exploited by the malicious actor with the network access to DNS server. See the referenced GitHub security advisory for patch details.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Produtos afetados
pi-hole · AdminLTE
CVEs relacionadas — pi-hole AdminLTE

No mesmo produto, das mais perigosas para as menos.

CVE-2021-32706HIGH(Authenticated) Remote Code Execution Possible in Web Interface 5.5EPSS 60.2%CVE-2022-23513MEDIUMPi-Hole/AdminLTE vulnerable due to improper access control in queryads endpointEPSS 42.3%CVE-2023-23614HIGHImproper session handling of "Remember me for 7 days" functionalityEPSS 1.0%CVE-2021-41175HIGHStored XSS in Client Groups Management (Authenticated)EPSS 0.9%CVE-2021-32793MEDIUMStored XSS Vulnerability in the Pi-hole WebinterfaceEPSS 0.8%CVE-2022-31029MEDIUMAuthenticated XSS in Pi-hole AdminLTEEPSS 0.5%