CVE-2004-1158 Other in n/a

High 7.5 Published 10 Dec 2004 Updated 8 Aug 2024

Remote attackers can spoof websites by injecting content into cross-domain windows, requiring user interaction to view the spoofed content.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2004-1158?

CVE-2004-1158 is a high-severity vulnerability in Mandrakesoft Mandrake Linux, published on 10 Dec 2004. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Konqueror 3.x up to 3.2.2-6, and possibly other versions, allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target window or tab whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the "window injection" vulnerability.

Which versions are affected by CVE-2004-1158?

It affects 3 products.

Products include Kde Konqueror, Mandrakesoft Mandrake Linux, Redhat Fedora Core.

How do I fix CVE-2004-1158?

Upgrade to a fixed version.

Is CVE-2004-1158 being exploited?

There is no known exploitation of CVE-2004-1158 in the wild and no public exploit code.

All Mandrakesoft Mandrake Linux vulnerabilities

Sources

Also known as GHSA-8m3g-xh55-wc3f.