CVE-2003-0459

2003-08-2704:00:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

kde

konqueror

authentication

credentials

http-referer

security vulnerability

cve-2003-0459

6.5 Medium

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.005 Low

EPSS

Percentile

76.2%

JSON

KDE Konqueror for KDE 3.1.2 and earlier does not remove authentication credentials from URLs of the “user:password@host” form in the HTTP-Referer header, which could allow remote web sites to steal the credentials for pages that link to the sites.

CPENameOperatorVersion
redhat:kdelibsredhat kdelibseq3.0.0-10
kde:konquerorkde konqueroreq3.1.2
redhat:kdelibsredhat kdelibseq2.2-11
kde:konquerorkde konqueroreq3.0.2
redhat:kdelibs_develredhat kdelibs develeq2.2-11
redhat:kdelibs_sound_develredhat kdelibs sound develeq2.2-11
redhat:analog_real-time_synthesizerredhat analog real-time synthesizereq2.2-11
kde:konquerorkde konqueroreq2.2.2
kde:konquerorkde konqueroreq3.1
kde:konquerorkde konqueroreq3.0

CPE	Name	Operator	Version
redhat:kdelibs	redhat kdelibs	eq	3.0.0-10
kde:konqueror	kde konqueror	eq	3.1.2
redhat:kdelibs	redhat kdelibs	eq	2.2-11
kde:konqueror	kde konqueror	eq	3.0.2
redhat:kdelibs_devel	redhat kdelibs devel	eq	2.2-11
redhat:kdelibs_sound_devel	redhat kdelibs sound devel	eq	2.2-11
redhat:analog_real-time_synthesizer	redhat analog real-time synthesizer	eq	2.2-11
kde:konqueror	kde konqueror	eq	2.2.2
kde:konqueror	kde konqueror	eq	3.1
kde:konqueror	kde konqueror	eq	3.0