CVE-2008-4677: vim netrw Credentials Management Errors
Vulnerability summary
CVE-2008-4677 is a medium (CVSS 4.3) Credentials Management Errors vulnerability in vim netrw. EPSS estimates a 1.95% chance of exploitation in the next 30 days, higher than 79.9% of scored vulnerabilities.
Timeline
- 22-10-2008PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
autoload/netrw.vim (aka the Netrw Plugin) 109, 131, and other versions before 133k for Vim 7.1.266, other 7.1 versions, and 7.2 stores credentials for an FTP session, and sends those credentials when attempting to establish subsequent FTP sessions to servers on different hosts, which allows remote FTP servers to obtain sensitive information in opportunistic circumstances by logging usernames and passwords. NOTE: the upstream vendor disputes a vector involving different ports on the same host, stating "I'm assuming that they're using the same id and password on that unchanged hostname, deliberately."
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
1.95%
Chance of exploitation in the next 30 days
Percentile
80%
Versus all other CVEs
30-day change
0.00 pp
From 1.95% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- vimAll versions (No fix recorded)
Vim1 product
- netrw109 | 110 | 111 | 112 | 113 | 114 | 115 | 116 | 118 | 120 | 121 | 122 | 123 | 128 | 131
2 vendors · 2 products
References
16 links- bugzilla.redhat.com/show_bug.cgi?id=461750X Refsource CONFIRM
Show all 16 references
- www.rdancer.org/vulnerablevim-netrw-credentials-dis.htmlX Refsource MISC
