CVE-2008-4677 | Vulnetix

CVE-2008-4677 PUBLISHED CVSS 4.300000190734863 MEDIUM

autoload/netrw.vim (aka the Netrw Plugin) 109, 131, and other versions before 133k for Vim 7.1.266, other 7.1 versions, and 7.2 stores credentials for an FTP session, and sends those credentials when attempting to establish subsequent FTP sessions to servers on different hosts, which allows remote FTP servers to obtain sensitive information in opportunistic circumstances by logging usernames and passwords. NOTE: the upstream vendor disputes a vector involving different ports on the same host, stating "I'm assuming that they're using the same id and password on that unchanged hostname, deliberately."

EPSS 1.95% · 78.8th percentile

Risk Scores

CVSS 2.0

4.300000190734863

EPSS Score

1.95%

78.8th percentile

Affected Products

Vendor	Product	Versions
n/a	n/a	n/a
vim	netrw	109, 110, 111

Timeline

Oct 22, 2008 CVE Published
Feb 4, 2022 EPSS Score
Mar 29, 2022 EPSS Score
May 21, 2022 EPSS Score
Sep 4, 2022 EPSS Score
Oct 27, 2022 EPSS Score
Dec 19, 2022 EPSS Score
Feb 10, 2023 EPSS Score
Mar 7, 2023 EPSS Score
Apr 4, 2023 EPSS Score
Jul 18, 2023 EPSS Score
Sep 9, 2023 EPSS Score

References

SUSE-SR:2009:007 vendor-advisory
https://bugzilla.redhat.com/show_bug.cgi?id=461750 url
[vim_dev] 20080817 Re: Anyone fixing SA31464? mailing-list
[oss-security] 20081020 CVE request (vim) mailing-list
[oss-security] 20081016 CVE request - Vim netrw.plugin mailing-list
20080812 Vim: Netrw: FTP User Name and Password Disclosure mailing-list
34418 third-party-advisory
30670 vdb
31464 third-party-advisory
ADV-2008-2379 vdb
[oss-security] 20081006 CVE request - (vim : netrw plugin - ftp user credentials disclosure) mailing-list
20080812 Re: Vim: Netrw: FTP User Name and Password Disclosure mailing-list
MDVSA-2008:236 vendor-advisory
http://www.rdancer.org/vulnerablevim-netrw-credentials-dis.html url
vim-netrw-ftp-information-disclosure(44419) vdb
https://nvd.nist.gov/vuln/detail/CVE-2008-4677 advisory

Open in Interactive Console →