PT-2024-30935 · Pi-Hole · Pi-Hole

Kiyell · Published 2024-08-18 · Updated 2024-10-29 · CVE-2024-44069

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Pi-hole versions prior to 6

Description The issue allows unauthenticated calls to "admin/api.php?setTempUnit=" to change the temperature units of the web dashboard. The supplier reportedly does not consider this a security issue, but the motivation for allowing arbitrary persons to change the value, which can be seen by the device owner, is unclear.

Recommendations For versions prior to 6, update to version 6 or later to resolve the issue. As a temporary workaround, consider restricting access to the "admin/api.php?setTempUnit=" endpoint until a patch is available.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-44069

Affected Products

Pi-Hole

References · 8

• 🔥 https://kiyell.com/The-Harmless-Pihole-Bug · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-44069 · Security Note
• https://osv.dev/vulnerability/CVE-2024-44069 · Vendor Advisory
• https://github.com/pi-hole/web/pull/3077 · Note
• https://twitter.com/VulmonFeeds/status/1825406869789114829 · Twitter Post
• https://twitter.com/CVEnew/status/1825356127606919432 · Twitter Post
• https://t.me/cvedetector/3504 · Telegram Post
• https://t.me/cvenotify/91088 · Telegram Post