KDE kio 4.10.3 noticifations about errors contain password

2013-05-10 / 2013-05-12
Credit: Seth Arnold
Risk: Medium
Local: Yes
Remote: No
CVE: CVE-2013-2074
CWE: CWE-200


CVSS Base Score: 5/10
Impact Subscore: 2.9/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: None
Availability impact: None

A bug in our Launchpad [1] refers to KDE Bug 319428 [2] as fixing a security issue: displaying raw URLs, including passwords, in a handful of error messages. A patch is in git [3] to sanitize URLs before displaying them in the affected error messages. 1: https://bugs.launchpad.net/ubuntu/+source/kde4libs/+bug/1178286 2: https://bugs.kde.org/show_bug.cgi?id=319428 3: http://commits.kde.org/kdelibs/65d736dab592bced4410ccfa4699de89f78c96ca

References:

https://bugs.launchpad.net/ubuntu/+source/kde4libs/+bug/1178286
https://bugs.kde.org/show_bug.cgi?id=319428
http://commits.kde.org/kdelibs/65d736dab592bced4410ccfa4699de89f78c96ca
http://seclists.org/oss-sec/2013/q2/303


See this note in RAW Version
Vote for this issue:
50%
50%

Comment it here.
Copyright 2025, cxsecurity.com

 

Back to Top