SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2021-29448

The Stored XSS exists in the Pi-hole Admin portal, which can be exploited by the malicious actor with the network access to DNS server.

HIGH 8.8EPSS 0.67%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.67%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. The Stored XSS exists in the Pi-hole Admin portal, which can be exploited by the malicious actor with the network access to DNS server. See the referenced GitHub security advisory for patch details.

CVSS 3.1
8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:H
EPSS
0.67% probability · 50th percentile
CISA KEV
Not listed
Weakness
CWE-79
Affected
pi-hole/ftldns · pi-hole/pi-hole · pi-hole/web interface
Source
security-advisories@github.com

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.