CVE-2003-0459 - Secunia Advisories - Vulnerability Information

CVE Reference: CVE-2003-0459
NOTE: The text on this page is written by CVE MITRE and reflects neither the opinions of Secunia or the results of our research. All data on this page is written and maintained by CVE MITRE.

Original Page at CVE MITRE: CVE-2003-0459

Description: KDE Konqueror for KDE 3.1.2 and earlier does not remove authentication credentials from URLs of the "user:password@host" form in the HTTP-Referer header, which could allow remote web sites to steal the credentials for pages that link to the sites.

CVE Status: Candidate

References: TURBO http://www.turbolinux.com/security/TLSA-2003-45.txt REDHAT http://www.redhat.com/support/errata/RHSA-2003-236.html http://www.redhat.com/support/errata/RHSA-2003-235.html OVAL http://oval.mitre.org/oval/definitions/data/oval411.html MANDRAKE http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:079 FULLDISC http://lists.grok.org.uk/pipermail/full-disclosure/2003-July/007300.html DEBIAN http://www.debian.org/security/2003/dsa-361 CONFIRM http://www.kde.org/info/security/advisory-20030729-1.txt CONECTIVA http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000747 BUGTRAQ http://marc.theaimsgroup.com/?l=bugtraq&m=105986238428061&w=2

Return to the previous page.