CVE-2021-32706

high · 7.6

Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web interface version 5.5.1, the `validDomainWildcard` preg_match filter allows a malicious character through that can be used to execute code, list directories, and overwrite sensitive files. The issue lies in the fact that one of the periods is not escaped, allowing any character to be used in its place. A patch for this vulnerability was released in version 5.5.1.

7.6

CVSS

60.2%

EPSS (exploit prob.)

99th

EPSS percentile

2021-08-04

Published

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

Weaknesses

CWE-94

Affected products

Vendor	Product	Affected versions
pi-hole	pi-hole	< 5.5.1

Check a specific version with /api/v1/cve/match.

References

https://github.com/pi-hole/AdminLTE/releases/tag/v5.5.1
https://github.com/pi-hole/AdminLTE/security/advisories/GHSA-5cm9-6p3m-v259
https://github.com/pi-hole/AdminLTE/releases/tag/v5.5.1
https://github.com/pi-hole/AdminLTE/security/advisories/GHSA-5cm9-6p3m-v259

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2021-32706