CVE-2021-29448
Last modified
CVE-2021-29448 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. The Stored XSS exists in the Pi-hole Admin portal, which can be exploited by the malicious actor with the network access to DNS server. EPSS estimates a 0.67% chance of exploitation in the next 30 days.
Description
Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. The Stored XSS exists in the Pi-hole Admin portal, which can be exploited by the malicious actor with the network access to DNS server. See the referenced GitHub security advisory for patch details.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Pi-Hole | Ftldns | 5.7 |
| Pi-Hole | Pi-Hole | 5.2.4 |
| Pi-Hole | Web Interface | < 5.5 |
References
- https://github.com/pi-hole/AdminLTE/security/advisories/GHSA-cwwf-93p7-73j9Exploit, Third Party Advisory
- https://github.com/pi-hole/AdminLTE/security/advisories/GHSA-cwwf-93p7-73j9Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-29448?
How severe is CVE-2021-29448?
How do I fix CVE-2021-29448?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-29442Nacos is a platform designed for dynamic service discovery a…7.5
- CVE-2021-29443jose is an npm library providing a number of cryptographic o…5.9
- CVE-2021-29444jose-browser-runtime is an npm package which provides a numb…5.9
- CVE-2021-29445jose-node-esm-runtime is an npm package which provides a num…5.9
- CVE-2021-29446jose-node-cjs-runtime is an npm package which provides a num…5.9
- CVE-2021-29447Wordpress is an open source CMS. A user with the ability to …6.5
- CVE-2021-29449Pi-hole is a Linux network-level advertisement and Internet …7.8
- CVE-2021-29450Wordpress is an open source CMS. One of the blocks in the Wo…4.3
- CVE-2021-29451Portofino is an open source web development framework. Porto…9.1
- CVE-2021-29452a12n-server is an npm package which aims to provide a simple…6.5
- CVE-2021-29453matrix-media-repo is an open-source multi-domain media repos…6.5
- CVE-2021-29454Smarty is a template engine for PHP, facilitating the separa…8.8
Are you affected by CVE-2021-29448?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST