CVE-2013-2120

HighCVSS 8.4/10Last modified Jun 16, 2026

Description

The %{password(...)} macro in pastemacroexpander.cpp in the KDE Paste Applet before 4.10.5 in kdeplasma-addons does not properly generate passwords, which allows context-dependent attackers to bypass authentication via a brute-force attack.

Metrics

CVSS 3.1 8.4/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	KDE Paste Applet	before 4.10.5

References

http://archives.neohapsis.com/archives/bugtraq/2013-05/0114.htmlBroken Link
http://openwall.com/lists/oss-security/2013/05/28/5Exploit, Mailing List, Third Party Advisory
http://openwall.com/lists/oss-security/2013/05/29/6Exploit, Mailing List, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=969421Issue Tracking, Patch, Third Party Advisory
https://projects.kde.org/projects/kde/kdeplasma-addons/repository/revisions/36a1fe49cb70f717c4a6e9eeee2c9186503a8dceMailing List, Patch, Vendor Advisory
http://archives.neohapsis.com/archives/bugtraq/2013-05/0114.htmlBroken Link
http://openwall.com/lists/oss-security/2013/05/28/5Exploit, Mailing List, Third Party Advisory
http://openwall.com/lists/oss-security/2013/05/29/6Exploit, Mailing List, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=969421Issue Tracking, Patch, Third Party Advisory
https://projects.kde.org/projects/kde/kdeplasma-addons/repository/revisions/36a1fe49cb70f717c4a6e9eeee2c9186503a8dceMailing List, Patch, Vendor Advisory

Timeline

Published: Feb 11, 2020
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-21216.0Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote authenticated users CVE-2013-21225.0The Edit Limit module 7.x-1.x before 7.x-1.3 for Drupal does not properly restrict access to comments, which allows remote authenticated use CVE-2013-21235.8The Node access user reference module 6.x-3.x before 6.x-3.5 and 7.x-3.x before 7.x-3.10 for Drupal does not properly restrict access to con CVE-2013-21244.3Double free vulnerability in inspect-fs.c in LibguestFS 1.20.x before 1.20.7, 1.21.x, 1.22.0, and 1.23.0 allows remote attackers to cause a CVE-2013-21255.0OpenSMTPD before 5.3.2 does not properly handle SSL sessions, which allows remote attackers to cause a denial of service (connection blockin CVE-2013-21267.5Multiple double free vulnerabilities in the LibRaw::unpack function in libraw_cxx.cpp in LibRaw before 0.15.2 allow context-dependent attack CVE-2013-21277.5Buffer overflow in the exposure correction code in LibRaw before 0.15.1 allows context-dependent attackers to cause a denial of service (cra CVE-2013-21285.5The tcp_read_sock function in net/ipv4/tcp.c in the Linux kernel before 2.6.34 does not properly manage skb consumption, which allows local CVE-2013-21294.3Cross-site scripting (XSS) vulnerability in the Webform module 6.x-3.x before 6.x-3.19 for Drupal allows remote authenticated users with the CVE-2013-21304.0ZNC 1.0 allows remote authenticated users to cause a denial of service (NULL pointer reference and crash) via a crafted request to the (1) e CVE-2013-21315.0Format string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows context-dependent attackers to cause a denial CVE-2013-21324.3bson/_cbsonmodule.c in the mongo-python-driver (aka. pymongo) before 2.5.2, as used in MongoDB, allows context-dependent attackers to cause