CVE-2002-1281 Code injection in n/a

High 7.5 Published 14 Nov 2002 Updated 8 Aug 2024

Remote attackers can execute arbitrary code via a malicious URL in the KDE rlogin KIO subsystem, requiring user interaction to trigger.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2002-1281?

CVE-2002-1281 is a high-severity code injection vulnerability in Kde Kde, published on 14 Nov 2002. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Unknown vulnerability in the rlogin KIO subsystem (rlogin.protocol) of KDE 2.x 2.1 and later, and KDE 3.x 3.0.4 and earlier, allows local and remote attackers to execute arbitrary code via a certain URL.

Which versions are affected by CVE-2002-1281?

It affects 1 product.

Products include Kde Kde.

How do I fix CVE-2002-1281?

Upgrade to a fixed version.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2002-1281 being exploited?

There is no known exploitation of CVE-2002-1281 in the wild and no public exploit code.

All Kde Kde vulnerabilities

Sources

Also known as GHSA-f5fj-2gr2-7787.