Description
kioslave/http/http.cpp in KIO in kdelibs 4.10.3 and earlier allows attackers to discover credentials via a crafted request that triggers an "internal server error," which includes the username and password in an error message.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 7 | kde4libs | 4:4.8.4-4+deb7u3 | DLA-952-1 |
Advisories 1
- DLA-952-1 kde4libs - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- [oss-security] 20130510 CVE request: password exposure in kdelibs when showing "internal server error" messages mailing-list
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=707776
- https://bugzilla.redhat.com/show_bug.cgi?id=961981
- https://projects.kde.org/projects/kde/kdelibs/repository/revisions/65d736dab592bced4410ccfa4699de89f78c96ca/diff/kioslave/http/http.cpp
- [oss-security] 20130510 Re: CVE request: password exposure in kdelibs when showing "internal server error" messages mailing-list
- 93244 vdb-entry
- USN-1842-1 vendor-advisory
- http://xorl.wordpress.com/2013/05/22/cve-2013-2074-kde-kdelibs-password-exposure/
- https://bugs.kde.org/show_bug.cgi?id=319428