VulnerabilityModified
CVE-2017-6410
kpac/script.cpp in KDE kio before 5.32 and kdelibs before 4.14.30 calls the PAC FindProxyForURL function with a full https URL (potentially including Basic Authentication credentials, a query string, or PATH_INFO), which allows remote attackers to…
MEDIUM 5.5EPSS 0.83%
Does this matter?
Lower severity and a low EPSS score (0.83%). Track it; it rarely justifies an emergency change on its own.
Description
kpac/script.cpp in KDE kio before 5.32 and kdelibs before 4.14.30 calls the PAC FindProxyForURL function with a full https URL (potentially including Basic Authentication credentials, a query string, or PATH_INFO), which allows remote attackers to obtain sensitive information via a crafted PAC file.
- CVSS 3.0
- 5.5 MEDIUMCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- EPSS
- 0.83% probability · 55th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-319
- Affected
- kde/kdelibs · kde/kio
- Source
- cve@mitre.org
References
- http://www.debian.org/security/2017/dsa-3849
- http://www.securityfocus.com/bid/96515
- https://www.kde.org/info/security/advisory-20170228-1.txtPatch, Vendor Advisory
- http://www.debian.org/security/2017/dsa-3849
- http://www.securityfocus.com/bid/96515
- https://www.kde.org/info/security/advisory-20170228-1.txtPatch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.