Published: 24/05/2021 Updated: 28/05/2021

CVSS v2 Base Score: 5.8 | Impact Score: 4.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 8.1 | Impact Score: 5.2 | Exploitability Score: 2.8

VMScore: 516

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N

An issue exists in GUPnP prior to 1.0.7 and 1.1.x and 1.2.x prior to 1.2.5. It allows DNS rebinding. A remote web server can exploit this vulnerability to trick a victim's browser into triggering actions against local UPnP services implemented using this library. Depending on the affected service, this could be used for data exfiltration, data tempering, etc.

Vulnerable Product	Search on Vulmon	Subscribe to Product
gnome gupnp

Debian Bug report logs - #989098 gupnp: CVE-2021-33516 Package: src:gupnp; Maintainer for src:gupnp is Debian GNOME Maintainers <pkg-gnome-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 25 May 2021 19:51:02 UTC Severity: important Tags: security, upstream Found ...

A flaw was found in gupnp DNS rebinding can occur when a victim's browser is used by a remote web server to trigger actions against local UPnP services including data exfiltration, data tempering, and other exploits The highest threat from this vulnerability is to data confidentiality and integrity (CVE-2021-33516) ...

No description is available for this CVE ...

An issue was discovered in GUPnP before 125 It allows DNS rebinding A remote web server can exploit this vulnerability to trick a victim's browser into triggering actions against local UPnP services implemented using this library Depending on the affected service, this could be used for data exfiltration, data tampering, etc ...

NVD-CWE-Other https://gitlab.gnome.org/GNOME/gupnp/-/issues/24 https://discourse.gnome.org/t/security-relevant-releases-for-gupnp-issue-cve-2021-33516/6536 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989098 https://nvd.nist.gov https://alas.aws.amazon.com/AL2/ALAS-2021-1673.html

CVE-2021-33516

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect