Test ID:	1.3.6.1.4.1.25623.1.0.145814
Category:	General
Title:	lipupnp < 1.14.6 DNS Rebind Vulnerability (GHSA-6hqq-w3jq-9fhg)
Summary:	libupnp is prone to a DNS rebind vulnerability.
Description:	Summary: libupnp is prone to a DNS rebind vulnerability. Vulnerability Insight: The server part of pupnp (libupnp) is vulnerable to DNS-rebinding attacks because it does not check the value of the Host header. A remote web server can exploit this vulnerability to trick the user browser into triggering actions on the local UPnP services implemented using this library. Depending on the affected service, this could be used for data exfiltration, data tempering, etc. Vulnerability Impact: This vulnerability can be used to exfiltrate the content of the media files exposed by a UPnP AV MediaServer server. Moreover, it could be possible to delete or upload files if this is enabled in the server configuration. Affected Software/OS: libupnp prior to version 1.14.6. Solution: Update to version 1.14.6 or later. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2021-29462 https://github.com/pupnp/pupnp/security/advisories/GHSA-6hqq-w3jq-9fhg http://www.openwall.com/lists/oss-security/2021/04/20/4
Copyright	Copyright (C) 2021 Greenbone Networks GmbH

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.