HTML Thumbnailer Plugin in KDE Applications Exposes User IP Addresses
CVE-2018-19120

7.5HIGH

Key Information:

Vendor

Kde

Status
Kde Applications
Vendor
CVE Published:
29 November 2018

What is CVE-2018-19120?

The HTML thumbnailer plugin in KDE Applications before version 18.12.0 is susceptible to a vulnerability that allows attackers to initiate outbound TCP connections to arbitrary IP addresses. This can lead to the unintended disclosure of the user's source IP address, potentially exposing sensitive information and enabling further exploitation of network security.

References

https://bugzilla.redhat.com/show_bug.cgi?id=1649420
x_refsource_MISC
https://lists.fedoraproject.org/archives/list/package-ann...
vendor-advisoryx_refsource_FEDORA

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.