Lucene search

[email protected]CVE-2021-41175

HistoryOct 26, 2021 - 2:15 p.m.

CVE-2021-41175

2021-10-2614:15:00

CWE-79

[email protected]

web.nvd.nist.gov

pi-hole

web interface

adminlte

cross-site scripting

cve-2021-41175

security patch

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

3.5 Low

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

25.4%

JSON

Pi-hole’s Web interface (based on AdminLTE) provides a central location to manage one’s Pi-hole and review the statistics generated by FTLDNS. Prior to version 5.8, cross-site scripting is possible when adding a client via the groups-clients management page. This issue was patched in version 5.8.

VendorProductVersionCPE
pi\\-holeadminlte*cpe:2.3:a:pi\\-hole:adminlte:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
pi\\-hole	adminlte	*	cpe:2.3:a:pi\\-hole:adminlte::::::::

References

github.com/pi-hole/AdminLTE/commit/01191c7a1b8d5032991ed9d88e0db8d3dbec744d

github.com/pi-hole/AdminLTE/releases/tag/v5.8

github.com/pi-hole/AdminLTE/security/advisories/GHSA-mhr8-7rvg-8r43

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

3.5 Low

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

25.4%

JSON

Related for CVE-2021-41175

osv1 openvas1 prion1