CVE-2020-35591

CVE-2020-35591 describes a Session Fixation vulnerability in Pi-hole versions 5.0, 5.1, and 5.1.1, where the application fails to generate a new session cookie upon user login. This allows an attacker to inject a pre-determined session cookie, which becomes valid after a victim logs in, granting the attacker unauthorized access to the user's account. Rated 5.4 MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N), it requires user interaction and network access for exploitation, potentially leading to low confidentiality and integrity impacts. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this vulnerability.