{"id":"CVE-2024-1433","summary":"KDE Plasma Workspace Theme File eventpluginsmanager.cpp enabledPlugins path traversal","details":"A vulnerability, which was classified as problematic, was found in KDE Plasma Workspace up to 5.93.0. This affects the function EventPluginsManager::enabledPlugins of the file components/calendar/eventpluginsmanager.cpp of the component Theme File Handler. The manipulation of the argument pluginId leads to path traversal. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The patch is named 6cdf42916369ebf4ad5bd876c4dfa0170d7b2f01. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-253407. NOTE: This requires write access to user's home or the installation of third party global themes.","modified":"2026-10-22T15:59:28.591399837Z","published":"2024-02-11T23:00:07.443Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"strategy":"StandaloneSingleVersion","range":[{"introduced":"5.28"},{"last_affected":"5.28"},{"introduced":"5.29"},{"last_affected":"5.29"},{"introduced":"5.30"},{"last_affected":"5.30"},{"introduced":"5.31"},{"last_affected":"5.31"},{"introduced":"5.32"},{"last_affected":"5.32"},{"introduced":"5.33"},{"last_affected":"5.33"},{"introduced":"5.34"},{"last_affected":"5.34"},{"introduced":"5.35"},{"last_affected":"5.35"},{"introduced":"5.36"},{"last_affected":"5.36"},{"introduced":"5.37"},{"last_affected":"5.37"},{"introduced":"5.38"},{"last_affected":"5.38"},{"introduced":"5.39"},{"last_affected":"5.39"},{"introduced":"5.40"},{"last_affected":"5.40"},{"introduced":"5.41"},{"last_affected":"5.41"},{"introduced":"5.42"},{"last_affected":"5.42"},{"introduced":"5.43"},{"last_affected":"5.43"},{"introduced":"5.44"},{"last_affected":"5.44"},{"introduced":"5.45"},{"last_affected":"5.45"},{"introduced":"5.46"},{"last_affected":"5.46"},{"introduced":"5.47"},{"last_affected":"5.47"},{"introduced":"5.48"},{"last_affected":"5.48"},{"introduced":"5.49"},{"last_affected":"5.49"},{"introduced":"5.50"},{"last_affected":"5.50"},{"introduced":"5.51"},{"last_affected":"5.51"},{"introduced":"5.52"},{"last_affected":"5.52"},{"introduced":"5.53"},{"last_affected":"5.53"},{"introduced":"5.54"},{"last_affected":"5.54"},{"introduced":"5.55"},{"last_affected":"5.55"},{"introduced":"5.56"},{"last_affected":"5.56"},{"introduced":"5.57"},{"last_affected":"5.57"},{"introduced":"5.58"},{"last_affected":"5.58"},{"introduced":"5.59"},{"last_affected":"5.59"},{"introduced":"5.60"},{"last_affected":"5.60"},{"introduced":"5.61"},{"last_affected":"5.61"},{"introduced":"5.62"},{"last_affected":"5.62"},{"introduced":"5.63"},{"last_affected":"5.63"},{"introduced":"5.64"},{"last_affected":"5.64"},{"introduced":"5.65"},{"last_affected":"5.65"},{"introduced":"5.66"},{"last_affected":"5.66"},{"introduced":"5.67"},{"last_affected":"5.67"},{"introduced":"5.68"},{"last_affected":"5.68"},{"introduced":"5.69"},{"last_affected":"5.69"},{"introduced":"5.70"},{"last_affected":"5.70"},{"introduced":"5.71"},{"last_affected":"5.71"},{"introduced":"5.72"},{"last_affected":"5.72"},{"introduced":"5.73"},{"last_affected":"5.73"},{"introduced":"5.74"},{"last_affected":"5.74"},{"introduced":"5.75"},{"last_affected":"5.75"},{"introduced":"5.76"},{"last_affected":"5.76"},{"introduced":"5.77"},{"last_affected":"5.77"},{"introduced":"5.78"},{"last_affected":"5.78"},{"introduced":"5.79"},{"last_affected":"5.79"},{"introduced":"5.80"},{"last_affected":"5.80"},{"introduced":"5.81"},{"last_affected":"5.81"},{"introduced":"5.82"},{"last_affected":"5.82"},{"introduced":"5.83"},{"last_affected":"5.83"},{"introduced":"5.84"},{"last_affected":"5.84"},{"introduced":"5.85"},{"last_affected":"5.85"},{"introduced":"5.86"},{"last_affected":"5.86"},{"introduced":"5.87"},{"last_affected":"5.87"},{"introduced":"5.88"},{"last_affected":"5.88"},{"introduced":"5.89"},{"last_affected":"5.89"}],"source":"AFFECTED_FIELD"}]}],"cna_assigner":"VulDB","cwe_ids":["CWE-22"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/1xxx/CVE-2024-1433.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/1xxx/CVE-2024-1433.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-1433"},{"type":"ADVISORY","url":"https://vuldb.com/?id.253407"},{"type":"REPORT","url":"https://vuldb.com/?ctiid.253407"},{"type":"FIX","url":"https://github.com/KDE/plasma-workspace/commit/6cdf42916369ebf4ad5bd876c4dfa0170d7b2f01"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/kde/plasma-workspace","events":[{"introduced":"f8357b6911399a375d88446d5609c4bdec0202ca"},{"fixed":"6cdf42916369ebf4ad5bd876c4dfa0170d7b2f01"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"5.0"},{"last_affected":"5.0"}]},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"5.1"},{"last_affected":"5.1"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"5.2"},{"last_affected":"5.2"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"5.3"},{"last_affected":"5.3"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"5.4"},{"last_affected":"5.4"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"5.5"},{"last_affected":"5.5"}]},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"5.6"},{"last_affected":"5.6"}]},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"5.7"},{"last_affected":"5.7"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"5.8"},{"last_affected":"5.8"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"5.9"},{"last_affected":"5.9"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"5.10"},{"last_affected":"5.10"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"5.11"},{"last_affected":"5.11"}]},{"range":[{"introduced":"5.12"},{"last_affected":"5.12"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"5.13"},{"last_affected":"5.13"}]},{"range":[{"introduced":"5.14"},{"last_affected":"5.14"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"5.15"},{"last_affected":"5.15"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"5.16"},{"last_affected":"5.16"}]},{"range":[{"introduced":"5.17"},{"last_affected":"5.17"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"5.18"},{"last_affected":"5.18"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"5.19"},{"last_affected":"5.19"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"5.20"},{"last_affected":"5.20"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"5.21"},{"last_affected":"5.21"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"5.22"},{"last_affected":"5.22"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"5.23"},{"last_affected":"5.23"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"5.24"},{"last_affected":"5.24"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"5.25"},{"last_affected":"5.25"}]},{"range":[{"introduced":"5.26"},{"last_affected":"5.26"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"5.27"},{"last_affected":"5.27"}]},{"range":[{"introduced":"5.90"},{"last_affected":"5.90"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"5.91"},{"last_affected":"5.91"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"5.92"},{"last_affected":"5.92"}]},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"5.93"},{"last_affected":"5.93"}],"source":"AFFECTED_FIELD"},{"range":[{"fixed":"6cdf42916369ebf4ad5bd876c4dfa0170d7b2f01"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["5.0","5.1","5.10","5.11","5.12","5.13","5.14","5.15","5.16","5.17","5.18","5.19","5.2","5.20","5.21","5.22","5.23","5.24","5.25","5.26","5.27","5.3","5.4","5.5","5.6","5.7","5.8","5.9","5.90","5.91","5.92","5.93","v5.92.0","v5.91.0","v5.90.0","v5.27.80","v5.26.90","v5.25.90","v5.24.90","v5.23.90","v5.22.90","v5.21.90","v5.20.90","v5.19.90","v5.18.90","v5.17.90","v5.16.90","v5.15.90","v5.14.90","v5.13.90","v5.12.90","v5.11.95","v5.9.95","v5.8.95","v5.7.95","v5.5.95","v5.5.4","v5.5.3","v5.5.2","v5.5.1","v5.5.0","v5.4.95","v5.3.95","v5.2.95","v5.1.95","v5.0.95","v5.0.0"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-1433.json","vanir_signatures":[{"target":{"file":"components/calendar/eventpluginsmanager.cpp","function":"EventPluginsManager::loadPlugin"},"deprecated":false,"digest":{"length":1358,"function_hash":"279606566870875631860544971438337704429"},"id":"CVE-2024-1433-257fba62","signature_type":"Function","signature_version":"v1","source":"https://github.com/kde/plasma-workspace/commit/6cdf42916369ebf4ad5bd876c4dfa0170d7b2f01"},{"digest":{"line_hashes":["153259459830839727386709227660223262369","196968847976321179737479555841409914391","240091221761429669563340059781325255973","54393385291603418381014105020527916161"],"threshold":0.9},"id":"CVE-2024-1433-f63d09a0","signature_type":"Line","signature_version":"v1","source":"https://github.com/kde/plasma-workspace/commit/6cdf42916369ebf4ad5bd876c4dfa0170d7b2f01","target":{"file":"components/calendar/eventpluginsmanager.cpp"},"deprecated":false}],"vanir_signatures_modified":"2026-10-22T15:59:28Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"}]}