Description
KDE Konqueror for KDE 3.1.2 and earlier does not remove authentication credentials from URLs of the "user:password@host" form in the HTTP-Referer header, which could allow remote web sites to steal the credentials for pages that link to the sites.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Advisories 1
- DSA-361 kdelibs, kdelibs-crypto - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 20030729 KDE Security Advisory: Konqueror Referrer Authentication Leak mailing-list
- http://www.kde.org/info/security/advisory-20030729-1.txt
- CLA-2003:747 vendor-advisory
- DSA-361 vendor-advisory
- oval:org.mitre.oval:def:411 vdb-entry signature
- 20030802 [slackware-security] KDE packages updated (SSA:2003-213-01) mailing-list
- RHSA-2003:236 vendor-advisory
- RHSA-2003:235 vendor-advisory
- TLSA-2003-45 vendor-advisory
- MDKSA-2003:079 vendor-advisory