Information disclosure in Kde Kdelibs

CVE-2013-2074

kioslave/http/http.cpp in KIO in kdelibs 4.10.3 and earlier allows attackers to discover credentials via a crafted request that triggers an "internal server error," which includes the username and password in an error message.

Vulnerability class: Information Disclosure

EPSS: 0.020 (78.5th percentile) — read the EPSS interpretation.

Affected products

  • Kde Kdelibs — versions 4.10.0, 4.10.1, 4.10.2
  • N/a — versions n/a

Weakness classification (CWE)

References