VULNERABILITY INTELLIGENCE

CVE-2017-6410

CVSS score5.5 MEDIUM
EPSS probability0.86%
CISA KEVNot currently listed
Published2017-03-02
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Description

kpac/script.cpp in KDE kio before 5.32 and kdelibs before 4.14.30 calls the PAC FindProxyForURL function with a full https URL (potentially including Basic Authentication credentials, a query string, or PATH_INFO), which allows remote attackers to obtain sensitive information via a crafted PAC file.

Weakness classification

  • CWE-319: Cleartext Transmission of Sensitive Information

Primary references