{"id":"CVE-2021-28117","aliases":["ALPINE-CVE-2021-28117","DEBIAN-CVE-2021-28117","EUVD-2021-14818","GHSA-vr8p-gg49-j8hx","MGASA-2021-0146","UBUNTU-CVE-2021-28117"],"status":"published","title":"libdiscover/backends/KNSBackend/KNSResource.cpp in KDE Discover before 5.21.3 automatically...","description":"libdiscover/backends/KNSBackend/KNSResource.cpp in KDE Discover before 5.21.3 automatically creates links to potentially dangerous URLs (that are neither https:// nor http://) based on the content of the store.kde.org web site. (5.18.7 is also a fixed version.)","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01563,"percentile":0.75593,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2021-03-18T10:52:54Z","modified":"2026-11-03T06:32:38Z","fixes":[{"ecosystem":"Alpine:v3.13","package":"discover","fixed_in":["5.20.5-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"discover","fixed_in":["5.21.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"discover","fixed_in":["5.21.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"discover","fixed_in":["5.21.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"discover","fixed_in":["5.21.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"discover","fixed_in":["5.21.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"discover","fixed_in":["5.21.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"discover","fixed_in":["5.21.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"discover","fixed_in":["5.21.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"discover","fixed_in":["5.21.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"discover","fixed_in":["5.21.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"discover","fixed_in":["5.21.3-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"plasma-discover","fixed_in":["5.20.5-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"plasma-discover","fixed_in":["5.20.5-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"plasma-discover","fixed_in":["5.20.5-3"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"discover","fixed_in":["5.15.4-2.2.mga7"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"discover","fixed_in":["5.20.4-3.1.mga8"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.13","package":"discover","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.20.5-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"discover","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.21.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"discover","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.21.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"discover","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.21.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"discover","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.21.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"discover","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.21.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"discover","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.21.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"discover","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.21.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"discover","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.21.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"discover","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.21.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"discover","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.21.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"discover","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.21.3-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"plasma-discover","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.20.5-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"plasma-discover","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.20.5-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"plasma-discover","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.20.5-3"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"discover","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.4-2.2.mga7"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"discover","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.20.4-3.1.mga8"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"plasma-discover","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.5.4-0ubuntu1","5.5.5-0ubuntu1","5.5.5-0ubuntu2","5.6.2-1ubuntu1","5.6.2-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"plasma-discover","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.10.5-0ubuntu1","5.11.3-0ubuntu1","5.11.4-0ubuntu1","5.11.5-0ubuntu1","5.12.0-0ubuntu1","5.12.0-0ubuntu2","5.12.1-0ubuntu1","5.12.1-0ubuntu2","5.12.2-0ubuntu1","5.12.2-0ubuntu2","5.12.3-0ubuntu1","5.12.4-0ubuntu1","5.12.5-0ubuntu0.1","5.12.5.1-0ubuntu0.1","5.12.6-0ubuntu0.1","5.12.7-0ubuntu0.1","5.12.8-0ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"plasma-discover","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.16.5-0ubuntu1","5.17.2-0ubuntu1","5.17.3-0ubuntu1","5.17.4-0ubuntu1","5.17.5-0ubuntu1","5.17.90-0ubuntu1","5.17.90-0ubuntu2","5.18.0-0ubuntu1","5.18.1-0ubuntu1","5.18.2-0ubuntu1","5.18.2-0ubuntu2","5.18.3-0ubuntu1","5.18.4.1-0ubuntu1","5.18.5-0ubuntu0.1","5.18.7-0ubuntu0.1"]}],"products":[{"vendor":"kde","product":"discover"}],"references":[{"url":"https://userbase.kde.org/Discover","tags":["x_transferred","Product","Vendor Advisory","advisory"]},{"url":"https://github.com/KDE/discover/releases","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://kde.org/info/security/advisory-20210310-1.txt","tags":["x_transferred","Patch","Vendor Advisory","fix","advisory","report"]},{"url":"https://invent.kde.org/plasma/discover/commit/94478827aab63d2e2321f0ca9ec5553718798e60","tags":["x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/KDE/discover/commit/fcd3b30552bf03a384b1a16f9bb8db029c111356","tags":["x_transferred","Patch","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28117"},{"url":"https://github.com/advisories/GHSA-vr8p-gg49-j8hx"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-28117","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-28117","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0146.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28581","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-28117","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-28117","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-28117","description":"libdiscover/backends/KNSBackend/KNSResource.cpp in KDE Discover before 5.21.3 automatically creates links to potentially dangerous URLs (that are neither https:// nor http://) based on the content of the store.kde.org web site. (5.18.7 is also a fixed version.)","status":"published","published":"2021-03-20T00:00:00Z","modified":"2024-10-15T18:08:32.926Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:33:08.811269Z"}],"euvd":[{"id":"EUVD-2021-14818","description":"libdiscover/backends/KNSBackend/KNSResource.cpp in KDE Discover before 5.21.3 automatically creates links to potentially dangerous URLs (that are neither https:// nor http://) based on the content of the store.kde.org web site. (5.18.7 is also a fixed version.)","status":"published","published":"2021-03-20T00:00:00Z","modified":"2024-10-15T18:08:32Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T00:27:36.689661Z"}],"ghsa":[{"id":"GHSA-vr8p-gg49-j8hx","title":"libdiscover/backends/KNSBackend/KNSResource.cpp in KDE Discover before 5.21.3 automatically...","description":"libdiscover/backends/KNSBackend/KNSResource.cpp in KDE Discover before 5.21.3 automatically creates links to potentially dangerous URLs (that are neither https:// nor http://) based on the content of the store.kde.org web site. (5.18.7 is also a fixed version.)","status":"published","published":"2022-05-24T17:44:58Z","modified":"2023-11-25T05:04:15Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T14:55:06.358976Z"}],"nvd":[{"id":"CVE-2021-28117","description":"libdiscover/backends/KNSBackend/KNSResource.cpp in KDE Discover before 5.21.3 automatically creates links to potentially dangerous URLs (that are neither https:// nor http://) based on the content of the store.kde.org web site. (5.18.7 is also a fixed version.)","status":"published","published":"2021-03-20T21:15:11.827Z","modified":"2026-06-17T03:45:49.78Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:06:50.805771Z"}],"osv":[{"id":"ALPINE-CVE-2021-28117","description":"libdiscover/backends/KNSBackend/KNSResource.cpp in KDE Discover before 5.21.3 automatically creates links to potentially dangerous URLs (that are neither https:// nor http://) based on the content of the store.kde.org web site. (5.18.7 is also a fixed version.)","status":"published","published":"2021-03-20T21:15:11.827Z","modified":"2026-11-03T06:32:38.717633788Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T07:17:20.312441Z"},{"id":"CVE-2021-28117","description":"libdiscover/backends/KNSBackend/KNSResource.cpp in KDE Discover before 5.21.3 automatically creates links to potentially dangerous URLs (that are neither https:// nor http://) based on the content of the store.kde.org web site. (5.18.7 is also a fixed version.)","status":"published","published":"2021-03-20T21:15:11.827Z","modified":"2026-10-20T14:04:46.651450832Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:19.129331Z"},{"id":"DEBIAN-CVE-2021-28117","description":"libdiscover/backends/KNSBackend/KNSResource.cpp in KDE Discover before 5.21.3 automatically creates links to potentially dangerous URLs (that are neither https:// nor http://) based on the content of the store.kde.org web site. (5.18.7 is also a fixed version.)","status":"published","published":"2021-03-20T21:15:11.827Z","modified":"2026-10-23T18:02:30.09962721Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:34.94143Z"},{"id":"UBUNTU-CVE-2021-28117","description":"libdiscover/backends/KNSBackend/KNSResource.cpp in KDE Discover before 5.21.3 automatically creates links to potentially dangerous URLs (that are neither https:// nor http://) based on the content of the store.kde.org web site. (5.18.7 is also a fixed version.)","status":"published","published":"2021-03-20T21:15:00Z","modified":"2025-10-24T04:50:13Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"MGASA-2021-0146","title":"Updated discover package fixes a security vulnerability","description":"Discover fetches the description and related texts of some applications/plugins\nfrom store.kde.org. That text is displayed to the user, after turning into a\nclickable link any part of the text that looks like a link. This is done for\nany kind of link, be it smb:// nfs:// etc. when in fact it only makes sense for\nhttp/https links. Opening links that the user has clicked on is not very\nproblematic but can be used to chain to other attack vectors. Given the\nintended functionality of the feature is just for http/https links it makes\nsense to do that verification (CVE-2021-28117).\n","status":"published","published":"2021-03-18T10:52:54Z","modified":"2026-04-16T04:43:55.352377068Z","updated_at":"2026-11-02T15:49:41.509337Z"}]}}