Medium severity · published Jul 7, 2022
CVE-2022-31029
Authenticated XSS in Pi-hole AdminLTE
4.8
CVSS
0.5%
EPSS
No
On KEV
Description
AdminLTE is a Pi-hole Dashboard for stats and configuration. In affected versions inserting code like `<script>alert("XSS")</script>` in the field marked with "Domain to look for" and hitting <kbd>enter</kbd> (or clicking on any of the buttons) will execute the script. The user must be logged in to use this vulnerability. Usually only administrators have login access to pi-hole, minimizing the risks. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
AdminLTE · pi-hole
< 5.13 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-31029
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-31029
Patch
https://github.com/pi-hole/AdminLTE/commit/b07372bd426ca8111824a0244dc89d07a7243509
Third Party Advisory
https://github.com/pi-hole/AdminLTE/security/advisories/GHSA-cfr5-rqm5-9vhp
More from AdminLTE
7.2
CVE-2020-8816
Pi-Hole AdminLTE Remote Code Execution Vulnerability
8.8
CVE-2023-23614
Improper session handling of "Remember me for 7 days" functionality
8.8
CVE-2021-32706
(Authenticated) Remote Code Execution Possible in Web Interface 5.5
8.8
CVE-2021-29448
Stored DOM XSS in Pi-hole Admin Web Interface
5.4
CVE-2021-41175
Stored XSS in Client Groups Management (Authenticated)