Session Fixation Vulnerability in Pi-hole by Pi-hole

CVE-2020-35591

What is CVE-2020-35591?

The vulnerability identified in Pi-hole versions 5.0, 5.1, and 5.1.1 involves an issue with session management. Users are susceptible to session fixation attacks because the application fails to generate a new session cookie upon user login. This allows an attacker to create and inject a malicious session cookie. Once a victim logs in, the injected cookie is accepted, granting the attacker unauthorized access to the victim's active session, potentially compromising sensitive user information.

References