CVE-2022-31029 Authenticated XSS in Pi-hole AdminLTE
Authenticated attackers can execute arbitrary scripts via the domain search field in the Pi-hole AdminLTE dashboard.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-31029?
CVE-2022-31029 is a medium-severity cross-site scripting vulnerability in pi-hole AdminLTE, published on 7 Jul 2022. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
AdminLTE is a Pi-hole Dashboard for stats and configuration. In affected versions inserting code like `<script>alert("XSS")</script>` in the field marked with "Domain to look for" and hitting <kbd>enter</kbd> (or clicking on any of the buttons) will execute the script. The user must be logged in to use this vulnerability. Usually only administrators have login access to pi-hole, minimizing the risks. Users are advised to upgrade. There are no known workarounds for this issue.
Weakness: CWE-79
Which versions are affected by CVE-2022-31029?
It affects 1 product.
Products include Pi-Hole Adminlte.
How do I fix CVE-2022-31029?
No fix has been published for CVE-2022-31029 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-31029 being exploited?
There is no known exploitation of CVE-2022-31029 in the wild and no public exploit code.
Other vulnerabilities in pi-hole AdminLTE
Sources
Also known as GHSA-cfr5-rqm5-9vhp.