CVE-2021-28117

libdiscover/backends/KNSBackend/KNSResource.cpp in KDE Discover before 5.21.3 automatically creates links to potentially dangerous URLs (that are neither https:// nor http://) based on the content of the store.kde.org web site. (5.18.7 is also a fixed version.)
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CISA-ADPADP
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 71%
Affected Products (NVD)
VendorProductVersion
kdediscover
𝑥
< 5.21.3
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
plasma-discover
bookworm
5.27.5-2
fixed
bullseye
5.20.5-3+deb11u2
fixed
buster
not-affected
sid
5.27.11-1
fixed
stretch
not-affected
trixie
5.27.11-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
plasma-discover
bionic
needs-triage
focal
needs-triage
groovy
ignored
hirsute
Fixed 5.21.3-0ubuntu1
released
impish
Fixed 5.21.3-0ubuntu1
released
jammy
Fixed 5.21.3-0ubuntu1
released
kinetic
Fixed 5.21.3-0ubuntu1
released
lunar
Fixed 5.21.3-0ubuntu1
released
mantic
Fixed 5.21.3-0ubuntu1
released
noble
Fixed 5.21.3-0ubuntu1
released
trusty
dne
xenial
needs-triage
References
https://github.com/KDE/discover/commit/fcd3b30552bf03a384b1a16f9bb8db029c111356
https://github.com/KDE/discover/releases
https://invent.kde.org/plasma/discover/commit/94478827aab63d2e2321f0ca9ec5553718798e60
https://kde.org/info/security/advisory-20210310-1.txt
https://userbase.kde.org/Discover
https://github.com/KDE/discover/commit/fcd3b30552bf03a384b1a16f9bb8db029c111356
https://github.com/KDE/discover/releases
https://invent.kde.org/plasma/discover/commit/94478827aab63d2e2321f0ca9ec5553718798e60
https://kde.org/info/security/advisory-20210310-1.txt
https://userbase.kde.org/Discover