Russian Vulnerability Scanner Database

Back to List

CVE-2024-34361

Scores

EPSS

0.582medium58.2%
0%20%40%60%80%100%

Percentile: 58.2%

CVSS

8.8high3.x
0246810

CVSS Score: 8.8/10

All CVSS Scores

CVSS 3.x
8.8

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. A vulnerability in versions prior to 5.18.3 allows an authenticated user to make internal requests to the server via the gravity_DownloadBlocklistFromUrl() function. Depending on some circumstances, the vulnerability could lead to remote command execution. Version 5.18.3 contains a patch for this issue.

Scaner-VS 7 — a modern vulnerability management solution

Uses this database for vulnerability detection. High-speed search, cross-platform, advanced configuration audit, and flexible filtering. Suitable for organizations of any size.
Learn more about Scaner-VS 7

Sources

anchore_overridesnvd

CWEs

CWE-918

Exploits

Exploit ID: CVE-2024-34361

Source: github-poc

URL: https://github.com/T0X1Cx/CVE-2024-34361-Pi-Hole-SSRF-to-RCE

Vulnerable Software (2)

Type: Configuration

Operating System:

Trait: 
{  "children": [    {      "cpe_match": [        {          "cpe23uri": "cpe:2.3:a:pi-hole:pi-hole:*:*:*:*:*:*:*:*",          "versionEndExcluding": "5.18.3"        }      ],      "negate": f...

Source: anchore_overrides

Type: Configuration

Vendor: *

Product: pi-hole

Operating System: * * *

Trait: 
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:pi-hole:pi-hole:*:*:*:*:*:*:*:*",      "versionEndExcluding": "5.18.3",      "vulnerable": true    }  ],  "operator": "OR"}

Source: nvd

End of list