Cross site scripting

2021-02-1820:15:00

PRIOn knowledge base

www.prio-n.com

0.001 Low

EPSS

Percentile

31.3%

JSON

Pi-hole 5.0, 5.1, and 5.1.1 allows XSS via the Options header to the admin/ URI. A remote user is able to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a Reflected Cross-Site Scripting attack against other users and steal the session cookie.

CPENameOperatorVersion
pi-holeeq5.0
pi-holeeq5.1
pi-holeeq5.1.1

Name	Operator	Version
pi-hole	eq	5.0
pi-hole	eq	5.1
pi-hole	eq	5.1.1

References

discourse.pi-hole.net/c/announcements/5

n4nj0.github.io/advisories/pi-hole-multiple-vulnerabilities-i/

0.001 Low

EPSS

Percentile

31.3%

JSON

Related for PRION:CVE-2020-35592