CVE-2021-29448

Published: Apr 15, 2021Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:H

Exploitability: 2.8 / Impact: 5.3

Source: NVD

Description

Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. The Stored XSS exists in the Pi-hole Admin portal, which can be exploited by the malicious actor with the network access to DNS server. See the referenced GitHub security advisory for patch details.

Affected (3)

Products: Pi Hole: Ftldns, Pi Hole, Web Interface

3 products

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Pi Hole Ftldns	Version 5.7
Pi Hole Pi Hole	Version 5.2.4
Pi Hole Web Interface	Before 5.5

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://github.com/pi-hole/AdminLTE/security/advisories/GHSA-cwwf-93p7-73j9

Source: security-advisories@github.com

ExploitThird Party Advisory

https://github.com/pi-hole/AdminLTE/security/advisories/GHSA-cwwf-93p7-73j9

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.