8.1

CVE-2021-33516: gnome gupnp

CVSS: 8.1v3.1HighModified
AliasesMGASA-2021-0321SUSE-SU-2021:2080-1SUSE-SU-2021:2153-1
Published 24-05-2021Last modified 03-08-2024
Open JSON

Vulnerability summary

CVE-2021-33516 is a high (CVSS 8.1) vulnerability in gnome gupnp. EPSS estimates a 1.08% chance of exploitation in the next 30 days, higher than 64.7% of scored vulnerabilities.

Overall risk
33/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.1/10
010
High · v3.1 (NVD)
EPSS score
1.08%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
OPENSUSE-SU-2024:10837-1

Timeline

  1. 24-05-2021
    PublishedVulnerability first disclosed.
  2. 03-08-2024
    Last modifiedVulnerability information updated.

Description

An issue was discovered in GUPnP before 1.0.7 and 1.1.x and 1.2.x before 1.2.5. It allows DNS rebinding. A remote web server can exploit this vulnerability to trick a victim's browser into triggering actions against local UPnP services implemented using this library. Depending on the affected service, this could be used for data exfiltration, data tempering, etc.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

1.08%

Chance of exploitation in the next 30 days

Percentile

65%

Versus all other CVEs

30-day change

0.00 pp

From 1.08% on 19-09-2026

19-09-202619-10-2026
EPSS score
1.08%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Suse8 products
  • gupnp&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP2< 1.2.2-3.3.1
  • gupnp&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP3< 1.2.2-3.3.1
  • gupnp&distro=SUSE Linux Enterprise Module for Package Hub 15 SP2< 1.2.2-3.3.1
  • gupnp&distro=SUSE Linux Enterprise Module for Package Hub 15 SP3< 1.2.2-3.3.1
  • gupnp&distro=SUSE Linux Enterprise Software Development Kit 12 SP5< 0.20.18-8.3.1
Redhat5 products
  • gupnp< 0:1.0.6-2.el8_4 | < 0:1.0.2-6.el7_9 | < 0:1.0.3-3.el8_2 | < 0:1.0.3-3.el8_1
  • gupnp-debuginfo< 0:1.0.6-2.el8_4 | < 0:1.0.2-6.el7_9 | < 0:1.0.3-3.el8_2 | < 0:1.0.3-3.el8_1
  • gupnp-debugsource< 0:1.0.6-2.el8_4 | < 0:1.0.3-3.el8_2 | < 0:1.0.3-3.el8_1
  • gupnp-devel< 0:1.0.6-2.el8_4 | < 0:1.0.2-6.el7_9 | < 0:1.0.3-3.el8_2 | < 0:1.0.3-3.el8_1
  • gupnp-docs< 0:1.0.2-6.el7_9
Mageia2 products
  • gupnp< 1.2.3-1.1.mga7
  • gupnp< 1.2.4-1.1.mga8
Opensuse2 products
  • gupnp&distro=openSUSE Leap 15.2< 1.2.2-lp152.2.3.1
  • gupnp&distro=openSUSE Leap 15.3< 1.2.2-3.3.1
Debian1 product
  • gupnp< 1.4.0-2
Gnome1 product
  • gupnp< 1.0.7 | ≥ 1.1.0, < 1.2.5
Ubuntu1 product
  • gupnp< 1.2.3-0ubuntu0.20.04.2 | All versions (No fix recorded)

7 vendors · 20 products

References

28 links
Show all 28 references