Vulnerability · Published Apr 14, 2021 · Assigned by GitHub_M
CVE-2021-29449Multiple Privilege Escalation Vulnerabilities Pihole
Medium 6.3
In plain English
A medium-severity privilege mismanagement in pi-hole from pi-hole. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit.
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)1.8%top 20.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Metasploit
Official description
Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. Multiple privilege escalation vulnerabilities were discovered in version 5.2.4 of Pi-hole core. See the referenced GitHub security advisory for details.
Affected products (as reported)
Weakness: CWE-269 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
References
- https://github.com/pi-hole/pi-hole/security/advisories/GHSA-3597-244c-wrpj x_refsource_CONFIRM
- https://www.compass-security.com/fileadmin/Research/Advisories/2021-02_CSNC-2021-008_Pi-hole_Privilege_Escalation.txt x_refsource_MISC, x_transferred
- http://packetstormsecurity.com/files/163715/Pi-Hole-Remove-Commands-Linux-Privilege-Escalation.html x_refsource_MISC, x_transferred