VULNERABILITY INTELLIGENCE

CVE-2024-34361

CVSS score8.5 HIGH
EPSS probability2.83%
CISA KEVNot currently listed
Published2024-07-05
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Description

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. A vulnerability in versions prior to 5.18.3 allows an authenticated user to make internal requests to the server via the `gravity_DownloadBlocklistFromUrl()` function. Depending on some circumstances, the vulnerability could lead to remote command execution. Version 5.18.3 contains a patch for this issue.

Weakness classification

  • security-advisories@github.com: CWE-918

Primary references