PT-2024-18043 · Kde · Kde Plasma Workspace

Andeasyteacher · Published 2024-02-11 · Updated 2024-09-05 · CVE-2024-1433

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions KDE Plasma Workspace versions up to 5.93.0

Description A problematic vulnerability was found in KDE Plasma Workspace, affecting the function EventPluginsManager::enabledPlugins of the file components/calendar/eventpluginsmanager.cpp of the component Theme File Handler. The manipulation of the argument pluginId leads to path traversal. It is possible to initiate the attack remotely. The complexity of an attack is rather high, and the exploitability is told to be difficult. This issue requires write access to the user's home or the installation of third-party global themes.

Recommendations To fix this issue, apply a patch, specifically the one named 6cdf42916369ebf4ad5bd876c4dfa0170d7b2f01, to KDE Plasma Workspace versions up to 5.93.0. As a temporary workaround, consider restricting access to the EventPluginsManager::enabledPlugins function until a patch is applied. Additionally, avoid using third-party global themes and restrict write access to the user's home to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-1433

Affected Products

Kde Plasma Workspace

References · 12

• https://github.com/KDE/plasma-workspace/commit/6cdf42916369ebf4ad5bd876c4dfa0170d7b2f01 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-1433 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-1433 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-1433 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-1433 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-1433 · Security Note
• https://t.me/cvenotify/93337 · Telegram Post
• https://vuldb.com/?id.253407 · Note
• https://twitter.com/CVEnew/status/1756818930817966094 · Twitter Post
• https://vuldb.com/?ctiid.253407 · Note
• https://twitter.com/VulmonFeeds/status/1756856281246179661 · Twitter Post
• https://t.me/cvenotify/70997 · Telegram Post