CVE-2013-2074 - Vulnerability Details - OpenCVE

kioslave/http/http.cpp in KIO in kdelibs 4.10.3 and earlier allows attackers to discover credentials via a crafted request that triggers an "internal server error," which includes the username and password in an error message.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Kde	Kdelibs

Configuration 1 [-]

OR	cpe:2.3:a:kde:kdelibs::::::::
	cpe:2.3:a:kde:kdelibs:4.10.0:::::::*
	cpe:2.3:a:kde:kdelibs:4.10.1:::::::*
	cpe:2.3:a:kde:kdelibs:4.10.2:::::::*

No data.

References

Link	Providers
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=707776
http://ubuntu.com/usn/usn-1842-1
http://www.openwall.com/lists/oss-security/2013/05/10/4
http://www.openwall.com/lists/oss-security/2013/05/11/2
http://www.osvdb.org/93244
http://xorl.wordpress.com/2013/05/22/cve-2013-2074-kde-kdelibs-password-exposure/
https://bugs.kde.org/show_bug.cgi?id=319428
https://bugzilla.redhat.com/show_bug.cgi?id=961981
https://nvd.nist.gov/vuln/detail/CVE-2013-2074
https://projects.kde.org/projects/kde/kdelibs/repository/revisions/65d736dab592bced4410ccfa4699de89f78c96ca/diff/kioslave/http/http.cpp
https://www.cve.org/CVERecord?id=CVE-2013-2074

History

No history.

MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2014-02-05T19:00:00

Updated: 2024-08-06T15:27:39.169Z

Reserved: 2013-02-19T00:00:00

Link: CVE-2013-2074

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2014-02-05T19:55:28.703

Modified: 2025-04-11T00:51:21.963

Link: CVE-2013-2074

Redhat

Severity : Low

Publid Date: 2013-05-06T00:00:00Z

Links: CVE-2013-2074 - Bugzilla

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2013-05-06T00:00:00", "descriptions": [{"lang": "en", "value": "kioslave/http/http.cpp in KIO in kdelibs 4.10.3 and earlier allows attackers to discover credentials via a crafted request that triggers an \"internal server error,\" which includes the username and password in an error message."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2014-02-05T18:57:01", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"name": "[oss-security] 20130510 CVE request: password exposure in kdelibs when showing \"internal server error\" messages", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2013/05/10/4"}, {"tags": ["x_refsource_MISC"], "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=707776"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=961981"}, {"tags": ["x_refsource_MISC"], "url": "https://projects.kde.org/projects/kde/kdelibs/repository/revisions/65d736dab592bced4410ccfa4699de89f78c96ca/diff/kioslave/http/http.cpp"}, {"name": "[oss-security] 20130510 Re: CVE request: password exposure in kdelibs when showing \"internal server error\" messages", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2013/05/11/2"}, {"name": "93244", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/93244"}, {"name": "USN-1842-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "http://ubuntu.com/usn/usn-1842-1"}, {"tags": ["x_refsource_MISC"], "url": "http://xorl.wordpress.com/2013/05/22/cve-2013-2074-kde-kdelibs-password-exposure/"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugs.kde.org/show_bug.cgi?id=319428"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T15:27:39.169Z"}, "title": "CVE Program Container", "references": [{"name": "[oss-security] 20130510 CVE request: password exposure in kdelibs when showing \"internal server error\" messages", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2013/05/10/4"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=707776"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=961981"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://projects.kde.org/projects/kde/kdelibs/repository/revisions/65d736dab592bced4410ccfa4699de89f78c96ca/diff/kioslave/http/http.cpp"}, {"name": "[oss-security] 20130510 Re: CVE request: password exposure in kdelibs when showing \"internal server error\" messages", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2013/05/11/2"}, {"name": "93244", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/93244"}, {"name": "USN-1842-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "http://ubuntu.com/usn/usn-1842-1"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://xorl.wordpress.com/2013/05/22/cve-2013-2074-kde-kdelibs-password-exposure/"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugs.kde.org/show_bug.cgi?id=319428"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2013-2074", "datePublished": "2014-02-05T19:00:00", "dateReserved": "2013-02-19T00:00:00", "dateUpdated": "2024-08-06T15:27:39.169Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:kde:kdelibs:*:*:*:*:*:*:*:*", "matchCriteriaId": "529D2FA3-7B25-46A9-B748-03BCBDC1ACA7", "versionEndIncluding": "4.10.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:kde:kdelibs:4.10.0:*:*:*:*:*:*:*", "matchCriteriaId": "4A1BF2C7-0945-4325-9514-F2F37E8CE43B", "vulnerable": true}, {"criteria": "cpe:2.3:a:kde:kdelibs:4.10.1:*:*:*:*:*:*:*", "matchCriteriaId": "B2C7808F-2203-43DF-808C-7A0B85367293", "vulnerable": true}, {"criteria": "cpe:2.3:a:kde:kdelibs:4.10.2:*:*:*:*:*:*:*", "matchCriteriaId": "61937C14-55DF-4E30-947D-21EC3F418E62", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "kioslave/http/http.cpp in KIO in kdelibs 4.10.3 and earlier allows attackers to discover credentials via a crafted request that triggers an \"internal server error,\" which includes the username and password in an error message."}, {"lang": "es", "value": "kioslave/http/http.cpp en KIO en kdelibs 4.10.3 y anteriores permite a atacantes remotos descubrir credenciales a trav\u00e9s de una solicitud manipulada que provoca un \"internal server error,\" el cual incluye el nombre de usuario y contrase\u00f1a en un mensaje de error."}], "id": "CVE-2013-2074", "lastModified": "2025-04-11T00:51:21.963", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2014-02-05T19:55:28.703", "references": [{"source": "secalert@redhat.com", "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=707776"}, {"source": "secalert@redhat.com", "url": "http://ubuntu.com/usn/usn-1842-1"}, {"source": "secalert@redhat.com", "url": "http://www.openwall.com/lists/oss-security/2013/05/10/4"}, {"source": "secalert@redhat.com", "url": "http://www.openwall.com/lists/oss-security/2013/05/11/2"}, {"source": "secalert@redhat.com", "url": "http://www.osvdb.org/93244"}, {"source": "secalert@redhat.com", "url": "http://xorl.wordpress.com/2013/05/22/cve-2013-2074-kde-kdelibs-password-exposure/"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "https://bugs.kde.org/show_bug.cgi?id=319428"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=961981"}, {"source": "secalert@redhat.com", "url": "https://projects.kde.org/projects/kde/kdelibs/repository/revisions/65d736dab592bced4410ccfa4699de89f78c96ca/diff/kioslave/http/http.cpp"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=707776"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://ubuntu.com/usn/usn-1842-1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2013/05/10/4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2013/05/11/2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/93244"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://xorl.wordpress.com/2013/05/22/cve-2013-2074-kde-kdelibs-password-exposure/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://bugs.kde.org/show_bug.cgi?id=319428"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=961981"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://projects.kde.org/projects/kde/kdelibs/repository/revisions/65d736dab592bced4410ccfa4699de89f78c96ca/diff/kioslave/http/http.cpp"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}]}