CVE-2020-35591: pi-hole Session Fixation

Vulnerability summary

CVE-2020-35591 is a medium (CVSS 5.8) Session Fixation vulnerability in pi-hole. EPSS estimates a 1.14% chance of exploitation in the next 30 days, higher than 66.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 18-02-2021
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

Pi-hole 5.0, 5.1, and 5.1.1 allows Session Fixation. The application does not generate a new session cookie after the user is logged in. A malicious user is able to create a new session cookie value and inject it to a victim. After the victim logs in, the injected cookie becomes valid, giving the attacker access to the user's account through the active session.

• CWE-384Session FixationAuthenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.