Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2008-4677

autoload/netrw.vim (aka the Netrw Plugin) 109, 131, and other versions before 133k for Vim 7.1.266, other 7.1 versions, and 7.2 stores credentials for an FTP session, and sends those credentials when attempting to establish subsequent FTP sessions to servers on different hosts, which allows remote FTP servers to obtain sensitive information in opportunistic circumstances by logging usernames and passwords. NOTE: the upstream vendor disputes a vector involving different ports on the same host, stating "I'm assuming that they're using the same id and password on that unchanged hostname, deliberately."

Published

2008-10-22T18:00:00.910

Last Modified

2025-04-09T00:30:58.490

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 4.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

8.6

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-255
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application vim vim 7.1 No
Application vim vim 7.1.266 No
Application vim vim 7.2 No
Application vim netrw 109 Yes
Application vim netrw 110 Yes
Application vim netrw 111 Yes
Application vim netrw 112 Yes
Application vim netrw 113 Yes
Application vim netrw 114 Yes
Application vim netrw 115 Yes
Application vim netrw 116 Yes
Application vim netrw 118 Yes
Application vim netrw 120 Yes
Application vim netrw 121 Yes
Application vim netrw 122 Yes
Application vim netrw 123 Yes
Application vim netrw 128 Yes
Application vim netrw 131 Yes
References