Vulnerability-Lookup - Search a vulnerability

Vulnerabilites related to gnome - gupnp

Vulnerability from fkie_nvd

Published

2021-05-24 15:15

Modified

2024-11-21 06:09

Severity ?

8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Summary

An issue was discovered in GUPnP before 1.0.7 and 1.1.x and 1.2.x before 1.2.5. It allows DNS rebinding. A remote web server can exploit this vulnerability to trick a victim's browser into triggering actions against local UPnP services implemented using this library. Depending on the affected service, this could be used for data exfiltration, data tempering, etc.

References

URL	Tags
cve@mitre.org	https://discourse.gnome.org/t/security-relevant-releases-for-gupnp-issue-cve-2021-33516/6536	Patch, Vendor Advisory
cve@mitre.org	https://gitlab.gnome.org/GNOME/gupnp/-/issues/24	Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://discourse.gnome.org/t/security-relevant-releases-for-gupnp-issue-cve-2021-33516/6536	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://gitlab.gnome.org/GNOME/gupnp/-/issues/24	Issue Tracking, Vendor Advisory

Impacted products

	Vendor	Product	Version
	gnome	gupnp	*
	gnome	gupnp	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:gnome:gupnp:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A06698C3-7DB7-4EF4-A21B-3DB06871BCBB",
              "versionEndExcluding": "1.0.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnome:gupnp:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F329C6E6-3442-4E58-8E0E-D422289CD579",
              "versionEndExcluding": "1.2.5",
              "versionStartIncluding": "1.1.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in GUPnP before 1.0.7 and 1.1.x and 1.2.x before 1.2.5. It allows DNS rebinding. A remote web server can exploit this vulnerability to trick a victim\u0027s browser into triggering actions against local UPnP services implemented using this library. Depending on the affected service, this could be used for data exfiltration, data tempering, etc."
    },
    {
      "lang": "es",
      "value": "Se detect\u00f3 un problema en GUPnP versiones anteriores a 1.0.7 y 1.1.x y versiones 1.2.x anteriores a 1.2.5.\u0026#xa0;Permite el reenlace de DNS.\u0026#xa0;Un servidor web remoto puede explotar esta vulnerabilidad para enga\u00f1ar al navegador de la v\u00edctima para desencadenar acciones contra los servicios UPnP locales implementados usando esta biblioteca.\u0026#xa0;Dependiendo del servicio afectado, esto podr\u00eda usarse para exfiltraci\u00f3n de datos, manipulaci\u00f3n de datos, etc"
    }
  ],
  "id": "CVE-2021-33516",
  "lastModified": "2024-11-21T06:09:00.090",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 4.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-05-24T15:15:07.400",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://discourse.gnome.org/t/security-relevant-releases-for-gupnp-issue-cve-2021-33516/6536"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "url": "https://gitlab.gnome.org/GNOME/gupnp/-/issues/24"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://discourse.gnome.org/t/security-relevant-releases-for-gupnp-issue-cve-2021-33516/6536"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "url": "https://gitlab.gnome.org/GNOME/gupnp/-/issues/24"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2021-33516 (GCVE-0-2021-33516)

Vulnerability from cvelistv5

Published

2021-05-24 14:53