XSS in Pi-Hole Adminlte
CVE-2021-32793
Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web interface version 5.5.1, the function to add domains to blocklists or allowlists is vulnerable to a stored cross-site-scripting vulnerability. User input added as a wildcard domain to a blocklist or allowlist is unfiltered in the web interface. Since the payload is stored permanently as a wildcard domain, this is a persistent XSS vulnerability. A remote attacker can therefore attack administrative user accounts through client-side attacks. Pi-hole Web Interface version 5.5.1 contains a patch for this vulnerability.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.7 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:H.
EPSS exploit prediction
EPSS: 0.008 (55.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 55th percentile — 55.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: 0.000
Affected products
- Pi-Hole Adminlte — versions < 5.5.1
- Pi-Hole
Weakness classification (CWE)
References
- github.com/pi-hole/AdminLTE/releases/tag/v5.5.1 (Third Party Advisory, Release Notes)
- github.com/pi-hole/AdminLTE/security/advisories/GHSA-g3w6-q4fg-p8x8 (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2021-32793?
- CVE-2021-32793 is a medium-severity vulnerability in Pi-Hole Adminlte, classified under Cross-site Scripting. CVSS score: 5.7/10. Published 2021-08-04.
- How severe is CVE-2021-32793?
- Medium severity. CVSS v3 base score is 5.7 out of 10.