VYPR
← All advisories
Medium severity5.4NVD Advisory· Published Feb 18, 2021· Updated Jun 17, 2026

CVE-2020-35591

CVE-2020-35591

Description

Pi-hole 5.0, 5.1, and 5.1.1 allows Session Fixation. The application does not generate a new session cookie after the user is logged in. A malicious user is able to create a new session cookie value and inject it to a victim. After the victim logs in, the injected cookie becomes valid, giving the attacker access to the user's account through the active session.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

5
  • Pi Hole/Pi Hole4 versions
    cpe:2.3:a:pi-hole:pi-hole:5.0:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:pi-hole:pi-hole:5.0:*:*:*:*:*:*:*
    • cpe:2.3:a:pi-hole:pi-hole:5.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:pi-hole:pi-hole:5.1:*:*:*:*:*:*:*
    • (no CPE)range: 5.0, 5.1, and 5.1.1
  • Pi-hole/Pi-holedescription

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.