CVE-2024-34361
High
Description
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. A vulnerability in versions prior to 5.18.3 allows an authenticated user to make internal requests to the server via the `gravity_DownloadBlocklistFromUrl()` function. Depending on some circumstances, the vulnerability could lead to remote command execution. Version 5.18.3 contains a patch for this issue.
SeverityHigh
CVSS8.5
Exploit probability—
ProductPi-hole
PublishedJul 5, 2024
First seenJul 5, 2024
Weakness typeCWE-918Server-side request forgery (SSRF)
How to fix
Update
- pi-hole pi-hole5.18.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pi-hole pi-hole | v < 5.18.3 | 5.18.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.