CVE-2003-0459

Fixed in a distro release EPSS 3%

KDE Konqueror for KDE 3.1.2 and earlier does not remove authentication credentials from URLs of the "user:password@host" form in the HTTP-Referer header, which could allow remote web sites to steal the credentials for pages that link to the sites.

Published 2003-08-01 · CVE record · OSV

Products: kde konqueror, kde konqueror_embedded, redhat analog_real-time_synthesizer, redhat kdebase, redhat kdelibs, redhat kdelibs_devel, redhat kdelibs_sound, redhat kdelibs_sound_devel

Distro releases