{"api_version":"1","generated_at":"2026-07-23T06:08:36+00:00","cve":"CVE-2013-7252","urls":{"html":"https://cve.report/CVE-2013-7252","api":"https://cve.report/api/cve/CVE-2013-7252.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2013-7252","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2013-7252"},"summary":{"title":"CVE-2013-7252","description":"kwalletd in KWallet before KDE Applications 14.12.0 uses Blowfish with ECB mode instead of CBC mode when encrypting the password store, which makes it easier for attackers to guess passwords via a codebook attack.","state":"PUBLISHED","assigner":"redhat","published_at":"2015-01-18 18:59:00","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-310","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"https://www.kde.org/info/security/advisory-20150109-1.txt","name":"https://www.kde.org/info/security/advisory-20150109-1.txt","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"","mime":"text/plain","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/67716","name":"http://www.securityfocus.com/bid/67716","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"kwallet Weak Stored Password Encryption Local Security Weakness","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.openwall.com/lists/oss-security/2014/01/02/3","name":"http://www.openwall.com/lists/oss-security/2014/01/02/3","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"oss-security - kwallet crypto misuse","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.openwall.com/lists/oss-security/2015/01/09/7","name":"http://www.openwall.com/lists/oss-security/2015/01/09/7","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"oss-security - Re: CVE Request: kwallet: incorrect CBC encryption\n handling","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://gaganpreet.in/blog/2013/07/24/kwallet-security-analysis/","name":"http://gaganpreet.in/blog/2013/07/24/kwallet-security-analysis/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"KWallet Security Analysis | Gaganpreet's blog","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://security.gentoo.org/glsa/201606-19","name":"https://security.gentoo.org/glsa/201606-19","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"kwalletd: Information disclosure (GLSA 201606-19) — Gentoo security","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1048168","name":"https://bugzilla.redhat.com/show_bug.cgi?id=1048168","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking"],"title":"Bug 1048168 – CVE-2013-7252 kwallet: crypto misuse","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-7252","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-7252","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2013","cve_id":"7252","vulnerable":"1","versionEndIncluding":"14.11.3","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"kde","cpe5":"kde_applications","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T18:01:20.414Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"http://gaganpreet.in/blog/2013/07/24/kwallet-security-analysis/"},{"name":"67716","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/67716"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://www.kde.org/info/security/advisory-20150109-1.txt"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1048168"},{"name":"[oss-security] 20140102 kwallet crypto misuse","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://www.openwall.com/lists/oss-security/2014/01/02/3"},{"name":"GLSA-201606-19","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"],"url":"https://security.gentoo.org/glsa/201606-19"},{"name":"[oss-security] 20150109 Re: CVE Request: kwallet: incorrect CBC encryption  handling","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://www.openwall.com/lists/oss-security/2015/01/09/7"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2013-07-24T00:00:00.000Z","descriptions":[{"lang":"en","value":"kwalletd in KWallet before KDE Applications 14.12.0 uses Blowfish with ECB mode instead of CBC mode when encrypting the password store, which makes it easier for attackers to guess passwords via a codebook attack."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2016-07-25T16:57:02.000Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"tags":["x_refsource_MISC"],"url":"http://gaganpreet.in/blog/2013/07/24/kwallet-security-analysis/"},{"name":"67716","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/67716"},{"tags":["x_refsource_CONFIRM"],"url":"https://www.kde.org/info/security/advisory-20150109-1.txt"},{"tags":["x_refsource_CONFIRM"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1048168"},{"name":"[oss-security] 20140102 kwallet crypto misuse","tags":["mailing-list","x_refsource_MLIST"],"url":"http://www.openwall.com/lists/oss-security/2014/01/02/3"},{"name":"GLSA-201606-19","tags":["vendor-advisory","x_refsource_GENTOO"],"url":"https://security.gentoo.org/glsa/201606-19"},{"name":"[oss-security] 20150109 Re: CVE Request: kwallet: incorrect CBC encryption  handling","tags":["mailing-list","x_refsource_MLIST"],"url":"http://www.openwall.com/lists/oss-security/2015/01/09/7"}]}},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2013-7252","datePublished":"2015-01-18T18:00:00.000Z","dateReserved":"2014-01-02T00:00:00.000Z","dateUpdated":"2024-08-06T18:01:20.414Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2015-01-18 18:59:00","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-310","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:kde:kde_applications:*:*:*:*:*:*:*:*","versionEndIncluding":"14.11.3","matchCriteriaId":"57F80208-1520-4A01-B357-0E85CC029F4A"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2013","CveId":"7252","Ordinal":"1","Title":"CVE-2013-7252","CVE":"CVE-2013-7252","Year":"2013"},"notes":[{"CveYear":"2013","CveId":"7252","Ordinal":"1","NoteData":"kwalletd in KWallet before KDE Applications 14.12.0 uses Blowfish with ECB mode instead of CBC mode when encrypting the password store, which makes it easier for attackers to guess passwords via a codebook attack.","Type":"Description","Title":"CVE-2013-7252"},{"CveYear":"2013","CveId":"7252","Ordinal":"2","NoteData":"2015-01-18","Type":"Other","Title":"Published"},{"CveYear":"2013","CveId":"7252","Ordinal":"3","NoteData":"2016-07-25","Type":"Other","Title":"Modified"}]}}}