CVE-2003-0692

2003-10-0604:00:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

kdm

kde

session cookie

vulnerability

brute force

nvd

6.3 Medium

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.009 Low

EPSS

Percentile

82.6%

JSON

KDM in KDE 3.1.3 and earlier uses a weak session cookie generation algorithm that does not provide 128 bits of entropy, which allows attackers to guess session cookies via brute force methods and gain access to the user session.

CPENameOperatorVersion
kde:kdekdeeq2.2.1
kde:kdekdeeq2.1.2
kde:kdekdeeq2.0
kde:kdekdeeq3.0.2
kde:kdekdeeq3.0.5
kde:kdekdeeq2.0_beta
kde:kdekdeeq2.2
kde:kdekdeeq3.1.1a
kde:kdekdeeq2.0.1
kde:kdekdeeq3.0.5b

CPE	Name	Operator	Version
kde:kde	kde	eq	2.2.1
kde:kde	kde	eq	2.1.2
kde:kde	kde	eq	2.0
kde:kde	kde	eq	3.0.2
kde:kde	kde	eq	3.0.5
kde:kde	kde	eq	2.0_beta
kde:kde	kde	eq	2.2
kde:kde	kde	eq	3.1.1a
kde:kde	kde	eq	2.0.1
kde:kde	kde	eq	3.0.5b