CVE-2021-29448 — HIGH (7.6)

Q: How severe is CVE-2021-29448?

CVE-2021-29448 has been rated HIGH with a CVSS base score of 7.6/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2021-29448?

Check the references section above for vendor advisories and patch information. Affected products include: Pi-Hole Ftldns, Pi-Hole Pi-Hole, Pi-Hole Web Interface.

Vulnerability Description

Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. The Stored XSS exists in the Pi-hole Admin portal, which can be exploited by the malicious actor with the network access to DNS server. See the referenced GitHub security advisory for patch details.

CVSS Score

7.6

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

LOW

Integrity

LOW

Availability

HIGH

Affected Products

Vendor	Product	Versions
Pi-Hole	Ftldns	5.7
Pi-Hole	Pi-Hole	5.2.4
Pi-Hole	Web Interface	< 5.5

Related Weaknesses (CWE)

CWE-79

References

https://github.com/pi-hole/AdminLTE/security/advisories/GHSA-cwwf-93p7-73j9ExploitThird Party Advisory
https://github.com/pi-hole/AdminLTE/security/advisories/GHSA-cwwf-93p7-73j9ExploitThird Party Advisory

FAQ

What is CVE-2021-29448?

CVE-2021-29448 is a vulnerability with a CVSS score of 7.6 (HIGH). Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. The Stored XSS exists in the Pi-hole Admin portal, which can be exploited by the malicious actor with the netw...

How severe is CVE-2021-29448?

CVE-2021-29448 has been rated HIGH with a CVSS base score of 7.6/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-29448?

Check the references section above for vendor advisories and patch information. Affected products include: Pi-Hole Ftldns, Pi-Hole Pi-Hole, Pi-Hole Web Interface.