CVE-2013-2074: Infoleak
It was reported [1] that when KDE encounters an "internal server error" and also prints out the URL that caused the error that it would include the username and password (if supplied) to the resource that caused the error. For instance, it would show "https://user:password@remotehost.com" or similar. This is due to kioslave/http/http.cpp using mrequest.url.url() rather than the sanitized mrequest.url.prettyUrl(). This issue is fixed in git [2].
Note that this information is printed out to the local user actively using the computer.
[1] https://bugs.kde.org/showbug.cgi?id=319428 [2] https://projects.kde.org/projects/kde/kdelibs/repository/revisions/65d736dab592bced4410ccfa4699de89f78c96ca/diff/kioslave/http/http.cpp
Other sources
kioslave/http/http.cpp in KIO in kdelibs 4.10.3 and earlier allows attackers to discover credentials via a crafted request that triggers an "internal server error," which includes the username and password in an error message.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2074?
CVE-2013-2074 is considered a moderate severity vulnerability due to the potential exposure of sensitive information.
How do I fix CVE-2013-2074?
To mitigate CVE-2013-2074, upgrade to kdelibs version 4.10.4 or later, where the issue has been addressed.
What impact does CVE-2013-2074 have on affected systems?
CVE-2013-2074 can lead to the unintentional disclosure of usernames and passwords in error messages.
Which versions of kdelibs are affected by CVE-2013-2074?
CVE-2013-2074 affects kdelibs versions 4.10.0 through 4.10.3.
Is CVE-2013-2074 exploitable remotely?
No, the vulnerability does not allow for remote exploitation but can expose credentials if the web server returns an internal server error.