Every CVE Search/ Get API key

CVE-2021-28117

libdiscover/backends/KNSBackend/KNSResource.cpp in KDE Discover before 5.21.3 automatically...

7.5 HighFix available

libdiscover/backends/KNSBackend/KNSResource.cpp in KDE Discover before 5.21.3 automatically creates links to potentially dangerous URLs (that are neither https:// nor http://) based on the content of the store.kde.org web site. (5.18.7 is also a fixed version.)

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

1.56%Up 0.5 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.5

libdiscover/backends/KNSBackend/KNSResource.cpp in KDE Discover before 5.21.3 automatically creates links to potentially dangerous URLs (that are neither https:// nor http://) based on the content of the store.kde.org web site. (5.18.7 is also a fixed version.)

Record
CVE-2021-28117
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Updated
2026-11-02
CVE List 7.5

libdiscover/backends/KNSBackend/KNSResource.cpp in KDE Discover before 5.21.3 automatically creates links to potentially dangerous URLs (that are neither https:// nor http://) based on the content of the store.kde.org web site. (5.18.7 is also a fixed version.)

Record
CVE-2021-28117
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
EUVDEUVD-2021-14818 7.5

libdiscover/backends/KNSBackend/KNSResource.cpp in KDE Discover before 5.21.3 automatically creates links to potentially dangerous URLs (that are neither https:// nor http://) based on the content of the store.kde.org web site. (5.18.7 is also a fixed version.)

Record
EUVD-2021-14818
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-vr8p-gg49-j8hx 7.5

libdiscover/backends/KNSBackend/KNSResource.cpp in KDE Discover before 5.21.3 automatically...

libdiscover/backends/KNSBackend/KNSResource.cpp in KDE Discover before 5.21.3 automatically creates links to potentially dangerous URLs (that are neither https:// nor http://) based on the content of the store.kde.org web site. (5.18.7 is also a fixed version.)

Record
GHSA-vr8p-gg49-j8hx
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVALPINE-CVE-2021-28117 7.5

libdiscover/backends/KNSBackend/KNSResource.cpp in KDE Discover before 5.21.3 automatically creates links to potentially dangerous URLs (that are neither https:// nor http://) based on the content of the store.kde.org web site. (5.18.7 is also a fixed version.)

Record
ALPINE-CVE-2021-28117
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-03
OSV 7.5

libdiscover/backends/KNSBackend/KNSResource.cpp in KDE Discover before 5.21.3 automatically creates links to potentially dangerous URLs (that are neither https:// nor http://) based on the content of the store.kde.org web site. (5.18.7 is also a fixed version.)

Record
CVE-2021-28117
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2021-28117 7.5

libdiscover/backends/KNSBackend/KNSResource.cpp in KDE Discover before 5.21.3 automatically creates links to potentially dangerous URLs (that are neither https:// nor http://) based on the content of the store.kde.org web site. (5.18.7 is also a fixed version.)

Record
DEBIAN-CVE-2021-28117
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2021-28117 7.5

libdiscover/backends/KNSBackend/KNSResource.cpp in KDE Discover before 5.21.3 automatically creates links to potentially dangerous URLs (that are neither https:// nor http://) based on the content of the store.kde.org web site. (5.18.7 is also a fixed version.)

Record
UBUNTU-CVE-2021-28117
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVMGASA-2021-0146 No score

Updated discover package fixes a security vulnerability

Discover fetches the description and related texts of some applications/plugins from store.kde.org. That text is displayed to the user, after turning into a clickable link any part of the text that looks like a link. This is done for any kind of link, be it smb:// nfs:// etc. when in fact it only makes sense for http/https links. Opening links that the user has clicked on is not very problematic but can be used to chain to other attack vectors. Given the intended functionality of the feature is just for http/https links it makes sense to do that verification (CVE-2021-28117).

Record
MGASA-2021-0146
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
discover
Alpine:v3.13
 before 5.20.5-r1
5.20.5-r1
discover
Alpine:v3.14
 before 5.21.3-r0
5.21.3-r0
discover
Alpine:v3.15
 before 5.21.3-r0
5.21.3-r0
discover
Alpine:v3.16
 before 5.21.3-r0
5.21.3-r0
discover
Alpine:v3.17
 before 5.21.3-r0
5.21.3-r0
discover
Alpine:v3.18
 before 5.21.3-r0
5.21.3-r0
discover
Alpine:v3.19
 before 5.21.3-r0
5.21.3-r0
discover
Alpine:v3.20
 before 5.21.3-r0
5.21.3-r0
discover
Alpine:v3.21
 before 5.21.3-r0
5.21.3-r0
discover
Alpine:v3.22
 before 5.21.3-r0
5.21.3-r0
Show 10 moreShow less
Affected packages
PackageAffectedFixed
discover
Alpine:v3.23
 before 5.21.3-r0
5.21.3-r0
discover
Alpine:v3.24
 before 5.21.3-r0
5.21.3-r0
plasma-discover
Debian:12
 before 5.20.5-3
5.20.5-3
plasma-discover
Debian:13
 before 5.20.5-3
5.20.5-3
plasma-discover
Debian:14
 before 5.20.5-3
5.20.5-3
discover
Mageia:7
 before 5.15.4-2.2.mga7
5.15.4-2.2.mga7
discover
Mageia:8
 before 5.20.4-3.1.mga8
5.20.4-3.1.mga8
plasma-discover
Ubuntu:16.04:LTS
 All versions, plus listed versions
5.5.4-0ubuntu15.5.5-0ubuntu15.5.5-0ubuntu25.6.2-1ubuntu15.6.2-1ubuntu1.1
 None known
plasma-discover
Ubuntu:18.04:LTS
 All versions, plus listed versions
5.10.5-0ubuntu15.11.3-0ubuntu15.11.4-0ubuntu15.11.5-0ubuntu15.12.0-0ubuntu1
Show 12 moreShow less
5.12.0-0ubuntu25.12.1-0ubuntu15.12.1-0ubuntu25.12.2-0ubuntu15.12.2-0ubuntu25.12.3-0ubuntu15.12.4-0ubuntu15.12.5-0ubuntu0.15.12.5.1-0ubuntu0.15.12.6-0ubuntu0.15.12.7-0ubuntu0.15.12.8-0ubuntu0.1
 None known
plasma-discover
Ubuntu:20.04:LTS
 All versions, plus listed versions
5.16.5-0ubuntu15.17.2-0ubuntu15.17.3-0ubuntu15.17.4-0ubuntu15.17.5-0ubuntu1
Show 10 moreShow less
5.17.90-0ubuntu15.17.90-0ubuntu25.18.0-0ubuntu15.18.1-0ubuntu15.18.2-0ubuntu15.18.2-0ubuntu25.18.3-0ubuntu15.18.4.1-0ubuntu15.18.5-0ubuntu0.15.18.7-0ubuntu0.1
 None known

History

History
RecordedChangedSources
affected, aliases, referencesOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-28117 is a high vulnerability (CVSS 7.5) in Kde Discover, published March 18, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.56%, the 75th percentile. Fixed in discover 5.20.5-r1.

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open