CVE-2021-33516
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2021-33516
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-33516.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2021-33516
- Downstream
- Related
- Published
- 2021-05-24T15:15:07Z
- Modified
- 2025-09-19T13:00:57.739238Z
- Severity
-
- 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
- Summary
- [none]
- Details
-
An issue was discovered in GUPnP before 1.0.7 and 1.1.x and 1.2.x before 1.2.5. It allows DNS rebinding. A remote web server can exploit this vulnerability to trick a victim's browser into triggering actions against local UPnP services implemented using this library. Depending on the affected service, this could be used for data exfiltration, data tempering, etc.
- References
Affected packages
Git / github.com/gnome/gupnp
Affected ranges
- Type
- GIT
- Repo
- https://github.com/gnome/gupnp
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
Affected versions
0.*
0.20.11
gupnp-0.*
gupnp-0.10
gupnp-0.12
gupnp-0.12.1
gupnp-0.12.2
gupnp-0.12.3
gupnp-0.12.4
gupnp-0.12.5
gupnp-0.12.6
gupnp-0.12.7
gupnp-0.12.8
gupnp-0.13
gupnp-0.13.1
gupnp-0.13.2
gupnp-0.13.3
gupnp-0.13.4
gupnp-0.13.5
gupnp-0.14.0
gupnp-0.15.0
gupnp-0.15.1
gupnp-0.16.0
gupnp-0.16.1
gupnp-0.17.0
gupnp-0.17.1
gupnp-0.17.2
gupnp-0.18.0
gupnp-0.19.0
gupnp-0.19.1
gupnp-0.19.2
gupnp-0.19.3
gupnp-0.19.4
gupnp-0.20.0
gupnp-0.20.1
gupnp-0.20.10
gupnp-0.20.11
gupnp-0.20.12
gupnp-0.20.13
gupnp-0.20.14
gupnp-0.20.15
gupnp-0.20.16
gupnp-0.20.17
gupnp-0.20.18
gupnp-0.20.2
gupnp-0.20.3
gupnp-0.20.4
gupnp-0.20.5
gupnp-0.20.6
gupnp-0.20.7
gupnp-0.20.8
gupnp-0.20.9
gupnp-0.99.0
gupnp-1.*
gupnp-1.0.0
gupnp-1.0.1
gupnp-1.0.2
gupnp-1.0.3
gupnp-1.0.4
gupnp-1.0.5
gupnp-1.0.6