CVE-2017-6410
kpac/script.cpp in KDE kio before 5.32 and kdelibs before 4.14.30 calls the PAC FindProxyForURL...
kpac/script.cpp in KDE kio before 5.32 and kdelibs before 4.14.30 calls the PAC FindProxyForURL function with a full https URL (potentially including Basic Authentication credentials, a query string, or PATH_INFO), which allows remote attackers to obtain sensitive information via a crafted PAC file.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
kpac/script.cpp in KDE kio before 5.32 and kdelibs before 4.14.30 calls the PAC FindProxyForURL function with a full https URL (potentially including Basic Authentication credentials, a query string, or PATH_INFO), which allows remote attackers to obtain sensitive information via a crafted PAC file.
- Record
CVE-2017-6410- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-319
- Updated
- 2026-11-02
CVE List No score
kpac/script.cpp in KDE kio before 5.32 and kdelibs before 4.14.30 calls the PAC FindProxyForURL function with a full https URL (potentially including Basic Authentication credentials, a query string, or PATH_INFO), which allows remote attackers to obtain sensitive information via a crafted PAC file.
- Record
CVE-2017-6410- Updated
- 2026-11-02
EUVDEUVD-2017-15467 No score
kpac/script.cpp in KDE kio before 5.32 and kdelibs before 4.14.30 calls the PAC FindProxyForURL function with a full https URL (potentially including Basic Authentication credentials, a query string, or PATH_INFO), which allows remote attackers to obtain sensitive information via a crafted PAC file.
- Record
EUVD-2017-15467- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6qcm-9vg4-jxv8
kpac/script.cpp in KDE kio before 5.32 and kdelibs before 4.14.30 calls the PAC FindProxyForURL...
kpac/script.cpp in KDE kio before 5.32 and kdelibs before 4.14.30 calls the PAC FindProxyForURL function with a full https URL (potentially including Basic Authentication credentials, a query string, or PATH_INFO), which allows remote attackers to obtain sensitive information via a crafted PAC file.
- Record
GHSA-6qcm-9vg4-jxv8- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-319
- Updated
- 2026-11-02
OSV
kpac/script.cpp in KDE kio before 5.32 and kdelibs before 4.14.30 calls the PAC FindProxyForURL function with a full https URL (potentially including Basic Authentication credentials, a query string, or PATH_INFO), which allows remote attackers to obtain sensitive information via a crafted PAC file.
- Record
CVE-2017-6410- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-6410
kpac/script.cpp in KDE kio before 5.32 and kdelibs before 4.14.30 calls the PAC FindProxyForURL function with a full https URL (potentially including Basic Authentication credentials, a query string, or PATH_INFO), which allows remote attackers to obtain sensitive information via a crafted PAC file.
- Record
DEBIAN-CVE-2017-6410- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2017-6410
kpac/script.cpp in KDE kio before 5.32 and kdelibs before 4.14.30 calls the PAC FindProxyForURL function with a full https URL (potentially including Basic Authentication credentials, a query string, or PATH_INFO), which allows remote attackers to obtain sensitive information via a crafted PAC file.
- Record
UBUNTU-CVE-2017-6410- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVMGASA-2017-0079 No score
Updated kdelibs4 packages fix security vulnerability
Using a malicious PAC file, and then using exfiltration methods in the PAC function FindProxyForURL() enables the attacker to expose full https URLs.
This is a security issue since https URLs may contain sensitive information in the URL authentication part (user:password@host), and in the path and the query (e.g. access tokens).
This attack can be carried out remotely (over the LAN) since proxy settings allow “Detect Proxy Configuration Automatically”. This setting uses WPAD to retrieve the PAC file, and an attacker who has access to the victim’s LAN can interfere with the WPAD protocols (DHCP/DNS+HTTP) and inject his/her own malicious PAC instead of the legitimate one
- Record
MGASA-2017-0079- Updated
- 2026-11-02
OSVopenSUSE-SU-2017:0677-1 No score
Security update for kdelibs4, kio
This update for kdelibs4, kio fixes the following issues:
- CVE-2017-6410: Information Leak when accessing https when using a malicious PAC file (boo#1027520)
- Record
openSUSE-SU-2017:0677-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2017:0680-1 No score
Security update for kdelibs4, kio
This update for kdelibs4, kio fixes the following issues:
- CVE-2017-6410: Information Leak when accessing https when using a malicious PAC file (boo#1027520)
- Record
openSUSE-SU-2017:0680-1- Updated
- 2026-11-02
OSVUSN-3223-1 No score
kde4libs vulnerability
Itzik Kotler, Yonatan Fridburg, and Amit Klein discovered that KDE-Libs incorrectly handled certain PAC files. A remote attacker could possibly use this issue to obtain sensitive information.
- Record
USN-3223-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
kioDebian:12 |
before 5.28.0-2 | 5.28.0-2 |
kioDebian:13 |
before 5.28.0-2 | 5.28.0-2 |
kioDebian:14 |
before 5.28.0-2 | 5.28.0-2 |
kde4libsDebian:7 From an advisory covering 3 CVEs |
before 4:4.8.4-4+deb7u3, plus listed versions 4:4.8.4-44:4.8.4-4+deb7u14:4.8.4-4+deb7u2 |
4:4.8.4-4+deb7u3 |
kde4libsDebian:8 From an advisory covering 2 CVEs |
before 4:4.14.2-5+deb8u2, plus listed versions 4:4.14.2-54:4.14.2-5+deb8u1 |
4:4.14.2-5+deb8u2 |
kdelibs4Mageia:5 |
before 4.14.30-1.mga5 | 4.14.30-1.mga5 |
kde4libsUbuntu:14.04:LTS |
before 4:4.13.3-0ubuntu0.4, plus listed versions 4:4.11.2-0ubuntu24:4.11.2-0ubuntu34:4.11.2-0ubuntu44:4.11.80-0ubuntu14:4.11.95-0ubuntu1 Show 19 moreShow less4:4.11.97-0ubuntu14:4.11.97-0ubuntu24:4.12.0-0ubuntu14:4.12.1-0ubuntu14:4.12.2-0ubuntu14:4.12.2-0ubuntu24:4.12.3-0ubuntu14:4.12.90-0ubuntu14:4.12.95-0ubuntu14:4.12.97-0ubuntu14:4.13.0-0ubuntu14:4.13.0-0ubuntu1.14:4.13.1-0ubuntu0.14:4.13.1-0ubuntu0.24:4.13.2a-0ubuntu0.24:4.13.2a-0ubuntu0.34:4.13.3-0ubuntu0.14:4.13.3-0ubuntu0.24:4.13.3-0ubuntu0.3 |
4:4.13.3-0ubuntu0.4 |
kde4libsUbuntu:16.04:LTS |
before 4:4.14.16-0ubuntu3.1, plus listed versions 4:4.14.13-0ubuntu14:4.14.13-0ubuntu24:4.14.13-0ubuntu34:4.14.13-0ubuntu44:4.14.13-0ubuntu64:4.14.16-0ubuntu14:4.14.16-0ubuntu3 |
4:4.14.16-0ubuntu3.1 |
kioUbuntu:16.04:LTS |
before 5.18.0-0ubuntu1.1, plus listed versions 5.15.0-0ubuntu25.15.0-0ubuntu35.18.0-0ubuntu1 |
5.18.0-0ubuntu1.1 |
kdelibs4SUSE:Package Hub 12 SP1 |
before 4.14.25-5.3 | 4.14.25-5.3 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
kdelibs4-apidocsSUSE:Package Hub 12 SP1 |
before 4.14.25-5.3 | 4.14.25-5.3 |
kioSUSE:Package Hub 12 SP1 |
before 5.26.0-5.1 | 5.26.0-5.1 |
kdelibs4SUSE:Package Hub 12 SP2 |
before 4.14.25-5.3 | 4.14.25-5.3 |
kdelibs4-apidocsSUSE:Package Hub 12 SP2 |
before 4.14.25-5.3 | 4.14.25-5.3 |
kioSUSE:Package Hub 12 SP2 |
before 5.26.0-5.1 | 5.26.0-5.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-6410 is a medium vulnerability (CVSS 5.5) in Kde Kdelibs, published March 2, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.86%, the 58th percentile. Fixed in kio 5.28.0-2.