PT-2017-17048 · Kde+1 · Kde Kio+2
Publicado
2017-03-02
·
Atualizado
2019-10-03
·
CVE-2017-6410
CVSS v3.1
5.5
Média
| Vetor | AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
KDE kio versions prior to 5.32
kdelibs versions prior to 4.14.30
Description
The issue allows remote attackers to obtain sensitive information via a crafted PAC file. This is due to the
kpac/script.cpp in KDE kio and kdelibs calling the PAC FindProxyForURL function with a full https URL, potentially including Basic Authentication credentials, a query string, or PATH INFO.Recommendations
For KDE kio versions prior to 5.32, update to version 5.32 or later.
For kdelibs versions prior to 4.14.30, update to version 4.14.30 or later.
Correção
Cleartext Transmission of Sensitive Information
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Kde Kio
Ubuntu
Kdelibs