CVE-2002-1151

2004-09-0104:00:00

[email protected]

web.nvd.nist.gov

cve-2002-1151

cross-site scripting

konqueror

kde

security vulnerability

remote code execution

cookie theft

6.1 Medium

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.012 Low

EPSS

Percentile

84.9%

JSON

The cross-site scripting protection for Konqueror in KDE 2.2.2 and 3.0 through 3.0.3 does not properly initialize the domains on sub-frames and sub-iframes, which can allow remote attackers to execute script and steal cookies from subframes that are in other domains.

Affected configurations

NVD

Node

kdekonquerorMatch2.2.2

kdekonquerorMatch3.0

kdekonquerorMatch3.0.1

kdekonquerorMatch3.0.2

kdekonquerorMatch3.0.3

Node

kdekdeMatch2.2.2

kdekdeMatch3.0

kdekdeMatch3.0.1

kdekdeMatch3.0.2

kdekdeMatch3.0.3

CPENameOperatorVersion
kde:konquerorkde konqueroreq2.2.2
kde:konquerorkde konqueroreq3.0
kde:konquerorkde konqueroreq3.0.1
kde:konquerorkde konqueroreq3.0.2
kde:konquerorkde konqueroreq3.0.3

CPE	Name	Operator	Version
kde:konqueror	kde konqueror	eq	2.2.2
kde:konqueror	kde konqueror	eq	3.0
kde:konqueror	kde konqueror	eq	3.0.1
kde:konqueror	kde konqueror	eq	3.0.2
kde:konqueror	kde konqueror	eq	3.0.3