Pi-hole vulnerability allows remote command execution
CVE-2024-34361

8.6HIGH

Key Information:

Vendor

Pi-hole

Status
Pi-hole
Vendor
CVE Published:
5 July 2024

Badges

👾 Exploit Exists🟣 EPSS 58%

What is CVE-2024-34361?

A vulnerability exists in Pi-hole versions prior to 5.18.3 that allows an authenticated user to make internal requests to the server via the gravity_DownloadBlocklistFromUrl() function. Exploitation of this vulnerability may lead to unauthorized remote command execution, posing a significant security risk for users. The issue is rectified in version 5.18.3. Users are strongly advised to update their systems to enhance security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

pi-hole < 5.18.3

References

https://github.com/pi-hole/pi-hole/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/pi-hole/pi-hole/commit/2c497a9a3ea0990...
x_refsource_MISC

EPSS Score

58% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

JSON
.