CVE-2024-1433

LowCVSS 3.7/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as problematic, was found in KDE Plasma Workspace up to 5.93.0. This affects the function EventPluginsManager::enabledPlugins of the file components/calendar/eventpluginsmanager.cpp of the component Theme File Handler. The manipulation of the argument pluginId leads to path traversal. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The patch is named 6cdf42916369ebf4ad5bd876c4dfa0170d7b2f01. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-253407. NOTE: This requires write access to user's home or the installation of third party global themes.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
KDE	Plasma Workspace	5.0; 5.1; 5.2; 5.3; 5.4; 5.5; 5.6; 5.7; 5.8; 5.9; 5.10; 5.11; 5.12; 5.13; 5.14; 5.15; 5.16; 5.17; 5.18; 5.19

References

https://github.com/KDE/plasma-workspace/commit/6cdf42916369ebf4ad5bd876c4dfa0170d7b2f01Patch
https://vuldb.com/?ctiid.253407Permissions Required
https://vuldb.com/?id.253407Third Party Advisory
https://github.com/KDE/plasma-workspace/commit/6cdf42916369ebf4ad5bd876c4dfa0170d7b2f01Patch
https://vuldb.com/?ctiid.253407Permissions Required
https://vuldb.com/?id.253407Third Party Advisory

Timeline

Published: Feb 11, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-14344.8Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jordy Meow Media Alt Renamer allows St CVE-2024-14357.5Insertion of Sensitive Information Into Sent Data vulnerability in tainacan Tainacan tainacan.This issue affects Tainacan: from n/a through CVE-2024-14365.3Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wiloke WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit.CVE-2024-14376.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in José Fernandez Adsmonetizer allows Ref CVE-2024-14387.7Missing Authorization vulnerability in PressFore Rolo Slider.This issue affects Rolo Slider: from n/a through 1.0.9.CVE-2024-14393.3Inadequate access control in Moodle LMS. This vulnerability could allow a local user with a student role to create arbitrary events intended CVE-2024-14406.1An open redirection vulnerability exists in multiple WSO2 products due to improper validation of the multi-option URL in the authentication CVE-2024-14415.5An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number of interfaces exceeds the size of CVE-2024-14428.8A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *. Doing this will grant the CVE-2024-14434.4MSI Afterburner v4.6.5.16370 is vulnerable to a Denial of Service vulnerability by triggering the 0x80002000 IOCTL code of the RTCore64.sys CVE-2024-14455.4The Page scroll to id plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to,CVE-2024-14464.3The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inc