Log in Start free

Vulnerability · Published May 11, 2020 · Assigned by mitre

CVE-2020-11108

High 8.8

In plain English

A high-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 78.3% (higher than 99.6% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code.

Severity (CVSS NVD)8.8High
Exploit odds (30 days)78.3%top 0.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling2Metasploit, Public PoC

Official description

The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files. This can be abused for Remote Code Execution by writing to a PHP file in the web directory. (Also, it can be used in conjunction with the sudo rule for the www-data user to escalate privileges to root.) The code error is in gravity_DownloadBlocklistFromUrl in gravity.sh.

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References