CVE-2021-28117 Open redirect in n/a
KDE Discover automatically creates links to dangerous URLs from store.kde.org, potentially bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-28117?
CVE-2021-28117 is a high-severity vulnerability in n/a, published on 20 Mar 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
libdiscover/backends/KNSBackend/KNSResource.cpp in KDE Discover before 5.21.3 automatically creates links to potentially dangerous URLs (that are neither https:// nor http://) based on the content of the store.kde.org web site. (5.18.7 is also a fixed version.)
Which versions are affected by CVE-2021-28117?
It affects 1 product.
Products include Kde Discover.
How do I fix CVE-2021-28117?
Upgrade to a fixed version.
Is CVE-2021-28117 being exploited?
There is no known exploitation of CVE-2021-28117 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2024-WS30553, DEBIAN-CVE-2021-28117, GHSA-vr8p-gg49-j8hx, MGASA-2021-0146, UBUNTU-CVE-2021-28117.