Описание
Pi-hole 5.0, 5.1, and 5.1.1 allows XSS via the Options header to the admin/ URI. A remote user is able to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a Reflected Cross-Site Scripting attack against other users and steal the session cookie.
Ссылки
- Release NotesVendor Advisory
- ExploitThird Party Advisory
- Release NotesVendor Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1
Одно из
cpe:2.3:a:pi-hole:pi-hole:5.0:*:*:*:*:*:*:*
cpe:2.3:a:pi-hole:pi-hole:5.1:*:*:*:*:*:*:*
cpe:2.3:a:pi-hole:pi-hole:5.1.1:*:*:*:*:*:*:*
EPSS
Процентиль: 39%
0.00177
Низкий
5.4 Medium
CVSS3
3.5 Low
CVSS2
Дефекты
CWE-79
Связанные уязвимости
github
больше 3 лет назад
Pi-hole 5.0, 5.1, and 5.1.1 allows XSS via the Options header to the admin/ URI. A remote user is able to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a Reflected Cross-Site Scripting attack against other users and steal the session cookie.
EPSS
Процентиль: 39%
0.00177
Низкий
5.4 Medium
CVSS3
3.5 Low
CVSS2
Дефекты
CWE-79