CVE-2004-0746

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2004-10-20 · updated 2026-06-16

Description

Konqueror in KDE 3.2.3 and earlier allows web sites to set cookies for country-specific top-level domains, such as .ltd.uk, .plc.uk and .firm.in, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session.

Affected products

gentoo Linux: 1.4
Kde: 3.1.3, 3.2
KDE Konqueror: 3.0, 3.0.1, 3.0.2, 3.0.3, 3.0.5, 3.0.5b (+7)
Mandrakesoft Mandrake Linux: 9.2, 10.0
Suse Linux: 8, 8.1, 8.2, 9.0, 9.1

References

http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000864
http://marc.info/?l=bugtraq&m=109327681304401&w=2
http://secunia.com/advisories/12341
http://www.kde.org/info/security/advisory-20040823-1.txt
http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:086
http://www.securityfocus.com/bid/10991
https://exchange.xforce.ibmcloud.com/vulnerabilities/17063
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11281
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000864
http://marc.info/?l=bugtraq&m=109327681304401&w=2
http://secunia.com/advisories/12341
http://www.kde.org/info/security/advisory-20040823-1.txt

Get alerted when CVE-2004-0746 or the next vulnerability affects your stack