CVE-2003-0459
published 2003-08-27CVE-2003-0459: KDE Konqueror for KDE 3.1.2 and earlier does not remove authentication credentials from URLs of the "user:password@host" form in the HTTP-Referer header, which…
PriorityP422medium5CVSS 2.0
AVNACLAuNCPINAN
EPSS
2.90%
86.9th percentile
KDE Konqueror for KDE 3.1.2 and earlier does not remove authentication credentials from URLs of the "user:password@host" form in the HTTP-Referer header, which could allow remote web sites to steal the credentials for pages that link to the sites.
Affected
27 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| kde | konqueror | — | — |
| kde | konqueror | — | — |
| kde | konqueror | — | — |
| kde | konqueror | — | — |
| kde | konqueror | — | — |
| kde | konqueror | — | — |
| kde | konqueror | — | — |
| kde | konqueror | — | — |
| kde | konqueror | — | — |
| kde | konqueror | — | — |
| kde | konqueror_embedded | — | — |
| redhat | analog_real-time_synthesizer | — | — |
| redhat | analog_real-time_synthesizer | — | — |
| redhat | kdebase | — | — |
| redhat | kdelibs | — | — |
| redhat | kdelibs | — | — |
| redhat | kdelibs | — | — |
| redhat | kdelibs | — | — |
| redhat | kdelibs_devel | — | — |
| redhat | kdelibs_devel | — | — |
| redhat | kdelibs_devel | — | — |
| redhat | kdelibs_devel | — | — |
| redhat | kdelibs_devel | — | — |
| redhat | kdelibs_sound | — | — |
| redhat | kdelibs_sound | — | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
security flaw
vendor_redhat·2003-07-29·CVSS 5.0
CVE-2003-0459 [MEDIUM] security flaw
security flaw
KDE Konqueror for KDE 3.1.2 and earlier does not remove authentication credentials from URLs of the "user:password@host" form in the HTTP-Referer header, which could allow remote web sites to steal the credentials for pages that link to the sites.
GHSA
GHSA-pfc7-m6xf-fmg6: KDE Konqueror for KDE 3
ghsa_unreviewed·2022-04-29
CVE-2003-0459 [MEDIUM] GHSA-pfc7-m6xf-fmg6: KDE Konqueror for KDE 3
KDE Konqueror for KDE 3.1.2 and earlier does not remove authentication credentials from URLs of the "user:password@host" form in the HTTP-Referer header, which could allow remote web sites to steal the credentials for pages that link to the sites.
No detection rules found.
No public exploits indexed.
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000747http://lists.grok.org.uk/pipermail/full-disclosure/2003-July/007300.htmlhttp://marc.info/?l=bugtraq&m=105986238428061&w=2http://www.debian.org/security/2003/dsa-361http://www.kde.org/info/security/advisory-20030729-1.txthttp://www.mandriva.com/security/advisories?name=MDKSA-2003:079http://www.redhat.com/support/errata/RHSA-2003-235.htmlhttp://www.redhat.com/support/errata/RHSA-2003-236.htmlhttp://www.turbolinux.com/security/TLSA-2003-45.txthttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A411http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000747http://lists.grok.org.uk/pipermail/full-disclosure/2003-July/007300.htmlhttp://marc.info/?l=bugtraq&m=105986238428061&w=2http://www.debian.org/security/2003/dsa-361http://www.kde.org/info/security/advisory-20030729-1.txthttp://www.mandriva.com/security/advisories?name=MDKSA-2003:079http://www.redhat.com/support/errata/RHSA-2003-235.htmlhttp://www.redhat.com/support/errata/RHSA-2003-236.htmlhttp://www.turbolinux.com/security/TLSA-2003-45.txthttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A411
2003-08-27
Published