CVE-2021-29448

Опубликовано: 15 апр. 2021

Источник: nvd

CVSS3: 7.6

CVSS3: 8.8

CVSS2: 5.8

EPSS Низкий

Описание

Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. The Stored XSS exists in the Pi-hole Admin portal, which can be exploited by the malicious actor with the network access to DNS server. See the referenced GitHub security advisory for patch details.

Ссылки

https://github.com/pi-hole/AdminLTE/security/advisories/GHSA-cwwf-93p7-73j9
Exploit
Third Party Advisory
https://github.com/pi-hole/AdminLTE/security/advisories/GHSA-cwwf-93p7-73j9
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:pi-hole:ftldns:5.7:*:*:*:*:*:*:*

cpe:2.3:a:pi-hole:pi-hole:5.2.4:*:*:*:*:*:*:*

cpe:2.3:a:pi-hole:web_interface:*:*:*:*:*:*:*:*

Версия до 5.5 (исключая)

EPSS

Процентиль: 53%

0.00303

Низкий

7.6 High

CVSS3

8.8 High

CVSS3

5.8 Medium

CVSS2

Дефекты

CWE-79

EPSS

Процентиль: 53%

0.00303

Низкий

7.6 High

CVSS3

8.8 High

CVSS3

5.8 Medium

CVSS2

Дефекты

CWE-79