CVE-2022-23513

Katalog CVE

CVSS 5.3 · Medium EPSS 41,1%

Kerentanan Improper Access Control pada pi-hole adminlte. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Pi-Hole is a network-wide ad blocking via your own Linux hardware, AdminLTE is a Pi-hole Dashboard for stats and more. In case of an attack, the threat actor will obtain the ability to perform an unauthorized query for blocked domains on `queryads` endpoint. In the case of application, this vulnerability exists because of a lack of validation in code on a root server path: `/admin/scripts/pi-hole/phpqueryads.php.` Potential threat actor(s) are able to perform an unauthorized query search in blocked domain lists. This could lead to the disclosure for any victims' personal blacklists.

Rincian

Terbit di NVD

23 Desember 2022

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control

EPSS (30 hari)

41,1% peluang dieksploitasi; lebih tinggi dari 98,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pi-hole/AdminLTE/releases/tag/v5.18 release notes · advisory pihak ketiga
• https://github.com/pi-hole/AdminLTE/security/advisories/GHSA-6qh8-6rrj-7497 exploit · advisory pihak ketiga
• http://packetstormsecurity.com/files/174460/AdminLTE-PiHole-Broken-Access-Control.html exploit