CVE-2002-1151 Cross-site scripting in n/a

High 7.5 Published 1 Sep 2004 Updated 8 Aug 2024

Remote attackers can execute scripts and steal cookies via improper domain initialization in Konqueror subframes, requiring user interaction.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2002-1151?

CVE-2002-1151 is a high-severity cross-site scripting vulnerability in Kde Kde, published on 1 Sep 2004. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The cross-site scripting protection for Konqueror in KDE 2.2.2 and 3.0 through 3.0.3 does not properly initialize the domains on sub-frames and sub-iframes, which can allow remote attackers to execute script and steal cookies from subframes that are in other domains.

Which versions are affected by CVE-2002-1151?

It affects 2 products.

Products include Kde Kde, Kde Konqueror.

How do I fix CVE-2002-1151?

Apply the vendor's patch.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2002-1151 being exploited?

There is no known exploitation of CVE-2002-1151 in the wild and no public exploit code.

All Kde Kde vulnerabilities

Sources

Also known as DSA-167, GHSA-4f6c-7wr6-73p6.