CVE-2024-34361

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2024-34361

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-34361.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-34361

Aliases

GHSA-jg6g-rrj6-xfg6

Published

2024-07-05T18:30:01Z

Modified

2025-11-02T15:01:52.969023Z

Severity

8.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Summary

Pi-hole Blind Server-Side Request Forgery (SSRF) vulnerability can lead to Remote Code Execution (RCE)

Details

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. A vulnerability in versions prior to 5.18.3 allows an authenticated user to make internal requests to the server via the gravity_DownloadBlocklistFromUrl() function. Depending on some circumstances, the vulnerability could lead to remote command execution. Version 5.18.3 contains a patch for this issue.

Database specific

{
    "cwe_ids": [
        "CWE-918"
    ]
}

References

Affected packages

Git / github.com/pi-hole/pi-hole

Affected ranges

Type: GIT
Repo: https://github.com/pi-hole/pi-hole
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

2c497a9a3ea099079bbcd1eb21725b0ed54b529d

Affected versions

2.*

2.0

2.8

V2.*

V2.5.1

V2.9.1

V2.9.2

v2.*

v2.1

v2.10

v2.10.1

v2.10.2

v2.11

v2.11.1

v2.11.2

v2.12

v2.12.1

v2.13

v2.13.1

v2.13.2

v2.2

v2.3

v2.4

v2.5

v2.5.2

v2.5.3

v2.6

v2.6.1

v2.6.1.1

v2.6.1.2

v2.6.2

v2.6.3

v2.7

v2.7.1

v2.8.1

v2.9

v2.9.3

v2.9.4

v2.9.4a

v2.9.5

v3.*

v3.0

v3.0.1

v3.1

v3.1.4

v3.2

v3.2.1

v3.3

v3.3.1

v4.*

v4.0

v4.1

v4.1.1

v4.2

v4.2.1

v4.2.2

v4.3

v4.3.1

v4.3.2

v4.3.3

v4.3.4

v4.3.5

v4.4

v5.*

v5.0

v5.1

v5.1.1

v5.1.2

v5.10

v5.11

v5.11.1

v5.11.2

v5.11.3

v5.11.4

v5.12

v5.12.1

v5.12.2

v5.13

v5.14

v5.14.1

v5.14.2

v5.15

v5.15.1

v5.15.2

v5.15.3

v5.15.4

v5.15.5

v5.16

v5.16.1

v5.16.2

v5.17

v5.17.1

v5.17.2

v5.17.3

v5.18

v5.18.1

v5.18.2

v5.2

v5.2.1

v5.2.2

v5.2.3

v5.2.4

v5.3

v5.3.1

v5.4

v5.5

v5.6

v5.7

v5.8

v5.8.1

v5.9

v5.9.1

Git / github.com/pi-hole/adminlte

Affected ranges

Type: GIT
Repo: https://github.com/pi-hole/adminlte
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

fb1b5c317e52ebb22380daf05fc94dddf001d6d7

Affected versions

0.*

0.1

1.*

1.0

1.1

1.2

1.2.1

1.3

2.*

2.0.0

2.1.0

2.1.1

v1.*

v1.0.0

v1.1.0

v1.1.1

v1.1.2

v1.1.3

v1.1.4

v1.1.5

v1.1.6

v1.1.7

v1.2

v1.3

v1.4

v1.4.1

v1.4.2

v1.4.3

v1.4.3.1

v1.4.3.1a

v1.4.4

v1.4.4.1

v1.4.4.2