CVE-2017-6410

Published: Mar 2, 2017Modified: May 13, 2026

5.5

Vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

kpac/script.cpp in KDE kio before 5.32 and kdelibs before 4.14.30 calls the PAC FindProxyForURL function with a full https URL (potentially including Basic Authentication credentials, a query string, or PATH_INFO), which allows remote attackers to obtain sensitive information via a crafted PAC file.

Affected (2)

Products: Kde: Kdelibs, Kio

2 products

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Kde Kdelibs	Up to 4.14.29
Kde Kio	Up to 5.31

Related CWEs

Cleartext Transmission of Sensitive Information

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

References (6)

http://www.debian.org/security/2017/dsa-3849

Source: cve@mitre.org

http://www.securityfocus.com/bid/96515

Source: cve@mitre.org

https://www.kde.org/info/security/advisory-20170228-1.txt

Source: cve@mitre.org

PatchVendor Advisory

http://www.debian.org/security/2017/dsa-3849

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/96515

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.kde.org/info/security/advisory-20170228-1.txt

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.