CVE-2008-4677

Summary

CVE	CVE-2008-4677
State	PUBLISHED
Assigner	mitre
Source Priority	CVE Program / NVD first with legacy fallback
Published	2008-10-22 18:00:00 UTC
Updated	2026-04-23 00:35:47 UTC
Description	autoload/netrw.vim (aka the Netrw Plugin) 109, 131, and other versions before 133k for Vim 7.1.266, other 7.1 versions, and 7.2 stores credentials for an FTP session, and sends those credentials when attempting to establish subsequent FTP sessions to servers on different hosts, which allows remote FTP servers to obtain sensitive information in opportunistic circumstances by logging usernames and passwords. NOTE: the upstream vendor disputes a vector involving different ports on the same host, stating "I'm assuming that they're using the same id and password on that unchanged hostname, deliberately."

Risk And Classification

Primary CVSS: v2.0 4.3 from [email protected]

AV:N/AC:M/Au:N/C:P/I:N/A:N

Problem Types: CWE-255 | n/a

CVSS v2.0 Breakdown

Access Vector

Network

Access Complexity

Medium

Authentication

None

Confidentiality

Partial

Integrity

None

Availability

None

AV:N/AC:M/Au:N/C:P/I:N/A:N

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Vim	Netrw	109	All	All	All
Application	Vim	Netrw	110	All	All	All
Application	Vim	Netrw	111	All	All	All
Application	Vim	Netrw	112	All	All	All
Application	Vim	Netrw	113	All	All	All
Application	Vim	Netrw	114	All	All	All
Application	Vim	Netrw	115	All	All	All
Application	Vim	Netrw	116	All	All	All
Application	Vim	Netrw	118	All	All	All
Application	Vim	Netrw	120	All	All	All
Application	Vim	Netrw	121	All	All	All
Application	Vim	Netrw	122	All	All	All
Application	Vim	Netrw	123	All	All	All
Application	Vim	Netrw	128	All	All	All
Application	Vim	Netrw	131	All	All	All
Application	Vim	Vim	7.1	All	All	All
Application	Vim	Vim	7.1.266	All	All	All
Application	Vim	Vim	7.2	All	All	All

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Na	N/a	affected n/a	Not specified

References

Reference	Source	Link	Tags
Webmail - OVH	af854a3a-2127-422b-91ae-364da2661108	www.vupen.com
SUSE Update for Multiple Packages - Advisories - Community	af854a3a-2127-422b-91ae-364da2661108	secunia.com
IBM X-Force Exchange	af854a3a-2127-422b-91ae-364da2661108	exchange.xforce.ibmcloud.com
461750 – (CVE-2008-4677) CVE-2008-4677 vim: netrw plugin: FTP username and password disclosure	af854a3a-2127-422b-91ae-364da2661108	bugzilla.redhat.com
Netrw: FTP User Name and Password Disclosure	af854a3a-2127-422b-91ae-364da2661108	www.rdancer.org
[security-announce] SUSE Security Summary Report: SUSE-SR:2009:007	af854a3a-2127-422b-91ae-364da2661108	lists.opensuse.org
oss-security - CVE request (vim)	af854a3a-2127-422b-91ae-364da2661108	www.openwall.com
SecurityFocus	af854a3a-2127-422b-91ae-364da2661108	www.securityfocus.com
Support / Security / Advisories / / MDVSA-2008:236 \| Mandriva	af854a3a-2127-422b-91ae-364da2661108	www.mandriva.com
Netrw Vim Script Information Disclosure Vulnerability	af854a3a-2127-422b-91ae-364da2661108	www.securityfocus.com
oss-security - CVE request - Vim netrw.plugin	af854a3a-2127-422b-91ae-364da2661108	www.openwall.com
Google Groups	af854a3a-2127-422b-91ae-364da2661108	groups.google.com
oss-security - CVE request - (vim : netrw plugin - ftp user credentials disclosure)	af854a3a-2127-422b-91ae-364da2661108	www.openwall.com
SecurityFocus	af854a3a-2127-422b-91ae-364da2661108	www.securityfocus.com
Vim Netrw FTP Credentials Disclosure Security Issue - Secunia Advisories - Vulnerability Intelligence - Secunia.com	af854a3a-2127-422b-91ae-364da2661108	secunia.com	Vendor Advisory
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

Vendor Comments And Credit

Organization	Published	Contributor	Statement
Red Hat	2008-10-25	Tomas Hoger	Not vulnerable. This issue did not affect the versions of vim as shipped with Red Hat Enterprise Linux 2.1, 3, 4, or 5.

There are currently no legacy QID mappings associated with this CVE.