CVE-2020-35592

Pi-hole 5.0, 5.1, and 5.1.1 allows XSS via the Options header to the admin/ URI

published February 18, 2021

CVSS
—
EPSS
1%
Percentile
58.0
In the wild
Unconfirmed
What it is

Pi-hole 5.0, 5.1, and 5.1.1 allows XSS via the Options header to the admin/ URI. A remote user is able to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a Reflected Cross-Site Scripting attack against other users and steal the session cookie.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00857 · 58.0th percentile
Published
2021-02-18T19:29Z
EPSS history
Timeline
  • 18 FEB 19:29Z
    Pi-hole 5.0, 5.1, and 5.1.1 allows XSS via the Options header to the admin/ URI
    cvelistv5