CVE-2004-0411: kde konqueror Argument Injection

CVSS: 7.5v2.0HighModified

AliasesDSA-518

Published 20-05-2004Last modified 08-08-2024

Vulnerability summary

CVE-2004-0411 is a high (CVSS 7.5) Argument Injection vulnerability in kde konqueror. EPSS estimates a 7.78% chance of exploitation in the next 30 days, higher than 94.6% of scored vulnerabilities.

Overall risk

32/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v2.0 (NVD)

EPSS score

7.78%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

20-05-2004
PublishedVulnerability first disclosed.
08-08-2024
Last modifiedVulnerability information updated.

Description

The URI handlers in Konqueror for KDE 3.2.2 and earlier do not properly filter "-" characters that begin a hostname in a (1) telnet, (2) rlogin, (3) ssh, or (4) mailto URI, which allows remote attackers to manipulate the options that are passed to the associated programs, possibly to read arbitrary files or execute arbitrary code.

CVSS metrics

1 score · 1 source · 1 version

v2.07.5

EPSS trend

Probability

7.78%

Chance of exploitation in the next 30 days

Percentile

95%

Versus all other CVEs

30-day change

0.00 pp

From 7.78% on 20-09-2026

20-09-202620-10-2026

EPSS score

7.78%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Affected systems

Debian1 product

kdelibs< 4:2.2.2-13.woody.10

Kde1 product

konqueror≤ 3.2.2

2 vendors · 2 products

References

17 links

www.redhat.com/support/errata/RHSA-2004-222.htmlVendor AdvisoryX Refsource REDHATBroken Link
www.novell.com/linux/security/advisories/2004_14_kdelibs.htmlVendor AdvisoryX Refsource SUSEBroken Link
www.kde.org/info/security/advisory-20040517-1.txtX Refsource CONFIRMPatchVendor Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/16163VDB EntryX Refsource XFThird Party Advisory
www.securityfocus.com/advisories/6717Vendor AdvisoryX Refsource FEDORABroken LinkThird Party AdvisoryVDB Entry
www.securityfocus.com/archive/1/363225Mailing ListX Refsource BUGTRAQBroken LinkThird Party AdvisoryVDB EntryVendor Advisory
www.debian.org/security/2004/dsa-518Vendor AdvisoryX Refsource DEBIANThird Party Advisory
www.securityfocus.com/advisories/6743Vendor AdvisoryX Refsource FEDORABroken LinkThird Party AdvisoryVDB Entry
www.osvdb.org/6107VDB EntryX Refsource OSVDBBroken Link
marc.info?l=bugtraq&m=108481412427344&w=2Mailing ListX Refsource BUGTRAQThird Party Advisory

Show all 17 references

secunia.com/advisories/11602Third Party AdvisoryX Refsource SECUNIABroken Link
distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000843Vendor AdvisoryX Refsource CONECTIVABroken Link
www.slackware.org/security/viewer.php?l=slackware-security&y=2004&m=slackware-security.362635Vendor AdvisoryX Refsource SLACKWAREBroken Link
security.gentoo.org/glsa/glsa-200405-11.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A954VDB EntrySignatureX Refsource OVALBroken LinkTool Signature
www.securityfocus.com/bid/10358VDB EntryX Refsource BIDBroken LinkThird Party Advisory
www.ciac.org/ciac/bulletins/o-146.shtmlThird Party AdvisoryGovernment ResourceX Refsource CIACBroken Link

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities