Unscored severity · published Jan 18, 2015
CVE-2013-7252
kwalletd in KWallet before KDE Applications 14.12.0 uses Blowfish with ECB mode instead of CBC mode when encrypting the password store, which makes it easier for attackers to…
–
CVSS
2.1%
EPSS
No
On KEV
Description
kwalletd in KWallet before KDE Applications 14.12.0 uses Blowfish with ECB mode instead of CBC mode when encrypting the password store, which makes it easier for attackers to guess passwords via a codebook attack.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KA
Kde Applications · Kde
through 14.11.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-7252
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-7252
Exploit
http://gaganpreet.in/blog/2013/07/24/kwallet-security-analysis/
www.openwall.com
http://www.openwall.com/lists/oss-security/2014/01/02/3
www.openwall.com
http://www.openwall.com/lists/oss-security/2015/01/09/7
Third Party Advisory
http://www.securityfocus.com/bid/67716
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1048168
Third Party Advisory
https://security.gentoo.org/glsa/201606-19
More from Kde Applications
7.5
CVE-2018-19120
The HTML thumbnailer plugin in KDE Applications before 18.12.0 allows attackers to trigger outbound TCP connections to arbitrary IP addresses, leading to disclosure of the source…
5.3
CVE-2018-19516
messagepartthemes/default/defaultrenderer.cpp in messagelib in KDE Applications before 18.12.0 does not properly restrict the handling of an http-equiv="REFRESH" value