CVE-2021-33516
CVE-2021-33516
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An issue was discovered in GUPnP before 1.0.7 and 1.1.x and 1.2.x before 1.2.5. It allows DNS rebinding. A remote web server can exploit this vulnerability to trick a victim's browser into triggering actions against local UPnP services implemented using this library. Depending on the affected service, this could be used for data exfiltration, data tempering, etc.
CVSS 8.1 · High · EPSS 1.1% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
gupnp Debian:12
- Affected ranges
- ECOSYSTEM: < 1.4.0-2
Update to 1.4.0-2
gupnp Debian:13
- Affected ranges
- ECOSYSTEM: < 1.4.0-2
Update to 1.4.0-2
gupnp Debian:14
- Affected ranges
- ECOSYSTEM: < 1.4.0-2
Update to 1.4.0-2
gupnp Ubuntu:16.04:LTS
- Versions
- 0.20.14-1
- 0.20.15-1
- 0.20.15-1ubuntu1
- 0.20.16-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
gupnp Ubuntu:18.04:LTS
- Versions
- 1.0.1-1
- 1.0.2-1
- 1.0.2-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
gupnp Ubuntu:20.04:LTS
- Versions
- 1.2.1-1
- 1.2.1-2
- 1.2.2-1
- 1.2.3-0ubuntu0.20.04.1
- Affected ranges
- ECOSYSTEM: < 1.2.3-0ubuntu0.20.04.2
Update to 1.2.3-0ubuntu0.20.04.2