Cyber Resilience

CVE-2023-23614

Pi-Hole Web Interface 4.0 – 5.18.3

Public PoC
Published
26 January 2023
Modified
21 November 2024
Patch / advisory
CVSS Score v3.1 8.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0097 59th percentile
Risk Priority 66 floored blend · peak EPSS

Summary

CVE-2023-23614 is a high-severity Insufficient Session Expiration (CWE-613) vulnerability in Pi-Hole Web Interface. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Pass the Hash (T1550.002); ranked in the top 41% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Pi-hole®'s Web interface (based off of AdminLTE) provides a central location to manage your Pi-hole. Versions 4.0 and above, prior to 5.18.3 are vulnerable to Insufficient Session Expiration. Improper use of admin WEBPASSWORD hash as "Remember me for 7 days"…

more

cookie value makes it possible for an attacker to "pass the hash" to login or reuse a theoretically expired "remember me" cookie. It also exposes the hash over the network and stores it unnecessarily in the browser. The cookie itself is set to expire after 7 days but its value will remain valid as long as the admin password doesn't change. If a cookie is leaked or compromised it could be used forever as long as the admin password is not changed. An attacker that obtained the password hash via an other attack vector (for example a path traversal vulnerability) could use it to login as the admin by setting the hash as the cookie value without the need to crack it to obtain the admin password (pass the hash). The hash is exposed over the network and in the browser where the cookie is transmitted and stored. This issue is patched in version 5.18.3.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1550.002 Pass the Hash Lateral Movement
Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls.
T1185 Browser Session Hijacking Collection
Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
T1550 Use Alternate Authentication Material Lateral Movement
Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.
T1550.004 Web Session Cookie Lateral Movement
Adversaries can use stolen session cookies to authenticate to web applications and services.
T1563 Remote Service Session Hijacking Lateral Movement
Adversaries may take control of preexisting sessions with remote services to move laterally in an environment.
T1539 Steal Web Session Cookie Credential Access
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-53533Same product: Pi-Hole Web Interface
CVE-2026-33405Same product: Pi-Hole Web Interface
CVE-2025-32785Same product: Pi-Hole Web Interface
CVE-2026-33403Same product: Pi-Hole Web Interface
CVE-2026-33406Same product: Pi-Hole Web Interface
CVE-2026-33404Same product: Pi-Hole Web Interface
CVE-2026-26953Same product: Pi-Hole Web Interface
CVE-2026-26952Same product: Pi-Hole Web Interface
CVE-2025-59151Same product: Pi-Hole Web Interface
CVE-2026-33765Same product: Pi-Hole Web Interface

Affected Assets

pi-hole
web interface
4.0 — 5.18.3

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-613

Locks the device (typically after inactivity) until re-authentication, addressing insufficient session expiration by preventing indefinite access.

addresses: CWE-613

Automatically terminating sessions after a defined period directly enforces session expiration, preventing indefinite session lifetimes that attackers can exploit.

addresses: CWE-613

Re-authentication after inactivity or time-based triggers prevents indefinite use of potentially hijacked or stale sessions.

addresses: CWE-613

Terminating sessions and network connections upon completion prevents insufficient session expiration.

addresses: CWE-613

Directly enforces termination of network sessions after inactivity or end-of-session, preventing indefinite session lifetime.

addresses: CWE-613

Consistent clocks across systems allow session expiration and timeout enforcement to function as intended in distributed environments.

addresses: CWE-613

When the non-persistent artifact is a session or connection, mandatory termination implements the missing expiration that CWE-613 describes.

addresses: CWE-613

Timed refresh of session-related information or on-demand generation plus deletion implements proper session expiration.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-01 mostly match
prevents

Credential lifecycle management directly includes enforcing session expiration to prevent reuse.

PR.AA-03 mostly match
prevents

Proper authentication mechanisms require passwords (not pre-hashed values) to be supplied by the claimant and verified server-side.

PR.AA-05 mostly match
prevents

Authorization policy enforcement and review covers terminating stale sessions to limit access scope.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

degrades

Directly requires secure handling and protection of authentication credentials, preventing storage or comparison of password hashes as if they were passwords.

degrades

Mandates secure authentication mechanisms that preclude the flawed practice of treating password hashes as authenticators.

degrades

Requires proper cryptographic practices for protecting passwords, indirectly mitigating misuse of hashes in authentication.

prevents

Secure coding guidance can prevent this implementation error but does not address the control's broader intent.

References