by Kastro
Paper/Archive/CVE-2020-8816

CVE-2020-8816

Pi-hole AdminLTE — Pi-Hole AdminLTE Remote Code Execution Vulnerability

KEV · due 10 JunEPSS 78%public exploitSSVC actCVSS 9.1
critical.is priorityof 100
97
CVSS 9.1 (CNA)9.1 / 10 × 3027.3In CISA KEV+3030.0EPSS percentile 99.6.996 × 2019.9Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

mitre (CNA)9.1CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:H/S:C/UI:N
CISA ADPSSVCExploitation: active · Automatable: no · Technical impact: total

References

refgithub.com/pi-hole/AdminLTE/commits/masterrefpacketstormsecurity.com/files/157861/Pi-Hole-4.3.2-DHCP-MAC-OS-Command-Execution.htmlrefnatedotred.wordpress.com/2020/03/28/cve-2020-8816-pi-hole-remote-code-executionreftwitter.com/Nate_Kappa/status/1243900213665902592?s=20refgithub.com/pi-hole/AdminLTE/releases/tag/v4.3.3refgithub.com/pi-hole/AdminLTE/pull/1165refpacketstormsecurity.com/files/158737/Pi-hole-4.3.2-Remote-Code-Execution.htmlrefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-8816kevcisa.gov/known-exploited-vulnerabilities-catalog