Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web interface version 5.5.1, the `validDomainWildcard` preg_match filter allows a malicious character through that can be used to execute code, list directories, and overwrite sensitive files. The issue lies in the fact that one of the periods is not escaped, allowing any character to be used in its place. A patch for this vulnerability was released in version 5.5.1.
oryginał ENCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:HPi Hole
APPPi-Hole< 5.5.1
Powiązane podatności
Command Injection w Pi-hole do wersji 3.3 — nieautoryzowane wykonanie poleceń OS
Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHC...
Pi-hole before 6 allows unauthenticated admin/api.php?setTempUnit= calls to change the temperature units of th...
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side softw...
The Pi-hole is a DNS sinkhole that protects your devices from unwanted content without installing any client-s...