PT-2021-23150

CVE-2021-41175

Published

2021-10-26

Updated

2021-10-28

Description by

CVSS 3.1

7.3

High

MetricsAV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Pi-hole versions prior to 5.8

Description The issue affects Pi-hole's Web interface, which is based on AdminLTE, allowing for cross-site scripting when adding a client via the groups-clients management page. This issue was patched in version 5.8.

Recommendations For versions prior to 5.8, update to version 5.8 to resolve the issue. As a temporary workaround, consider restricting access to the groups-clients management page until the update is applied.

Exploitability

Exploit

Fix

Impacts

Researchers

Robert Punnett

Stypr

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers