CVE-2021-32706: falha de alta gravidade em pi-hole AdminLTE
(Authenticated) Remote Code Execution Possible in Web Interface 5.5
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
48Vexday Risk Score
Corrija em breve. Ela tem exploit funcional público.
ssvc Attendcvss 7.6epss 60%
da publicação à armano mesmo dia
Publicada no NVD4 de ago.
metasploit4 de ago.
Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web interface version 5.5.1, the `validDomainWildcard` preg_match filter allows a malicious character through that can be used to execute code, list directories, and overwrite sensitive files. The issue lies in the fact that one of the periods is not escaped, allowing any character to be used in its place. A patch for this vulnerability was released in version 5.5.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Produtos afetados
pi-hole · AdminLTECVEs relacionadas — pi-hole AdminLTE
No mesmo produto, das mais perigosas para as menos.
CVE-2022-23513MEDIUMPi-Hole/AdminLTE vulnerable due to improper access control in queryads endpointEPSS 42.3%CVE-2023-23614HIGHImproper session handling of "Remember me for 7 days" functionalityEPSS 1.0%CVE-2021-41175HIGHStored XSS in Client Groups Management (Authenticated)EPSS 0.9%CVE-2021-32793MEDIUMStored XSS Vulnerability in the Pi-hole WebinterfaceEPSS 0.8%CVE-2021-29448HIGHStored DOM XSS in Pi-hole Admin Web InterfaceEPSS 0.7%CVE-2022-31029MEDIUMAuthenticated XSS in Pi-hole AdminLTEEPSS 0.5%