{"api_version":"1","generated_at":"2026-07-23T05:38:41+00:00","cve":"CVE-2008-3076","urls":{"html":"https://cve.report/CVE-2008-3076","api":"https://cve.report/api/cve/CVE-2008-3076.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2008-3076","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2008-3076"},"summary":{"title":"CVE-2008-3076","description":"The Netrw plugin 125 in netrw.vim in Vim 7.2a.10 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames used by the execute and system functions within the (1) mz and (2) mc commands, as demonstrated by the netrw.v2 and netrw.v3 test cases.  NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712.","state":"PUBLISHED","assigner":"mitre","published_at":"2009-02-21 22:30:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-78","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"9.3","severity":"","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:C/I:C/A:C","baseScore":9.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"}}],"references":[{"url":"http://secunia.com/advisories/34418","name":"http://secunia.com/advisories/34418","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SUSE Update for Multiple Packages - Advisories - Community","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0324","name":"http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0324","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"504"},{"url":"http://marc.info/?l=oss-security&m=122416184431388&w=2","name":"http://marc.info/?l=oss-security&m=122416184431388&w=2","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"'[oss-security] CVE request - Vim netrw.plugin' - MARC","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.openwall.com/lists/oss-security/2008/07/08/12","name":"http://www.openwall.com/lists/oss-security/2008/07/08/12","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"oss-security - Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://marc.info/?l=bugtraq&m=121494431426308&w=2","name":"http://marc.info/?l=bugtraq&m=121494431426308&w=2","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"'Re: Collection of Vulnerabilities in Fully Patched Vim 7.1' - MARC","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.openwall.com/lists/oss-security/2008/07/07/1","name":"http://www.openwall.com/lists/oss-security/2008/07/07/1","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"oss-security - Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html","name":"http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"[security-announce] SUSE Security Summary Report: SUSE-SR:2009:007","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.rdancer.org/vulnerablevim-netrw.html","name":"http://www.rdancer.org/vulnerablevim-netrw.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Patch","Vendor Advisory"],"title":"Arbitrary code execution in Netrw version 125, Vim 7.2a.10","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://www.redhat.com/support/errata/RHSA-2008-0580.html","name":"http://www.redhat.com/support/errata/RHSA-2008-0580.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Support","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.openwall.com/lists/oss-security/2008/10/20/2","name":"http://www.openwall.com/lists/oss-security/2008/10/20/2","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"oss-security - CVE request (vim)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2008:236","name":"http://www.mandriva.com/security/advisories?name=MDVSA-2008:236","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Support / Security / Advisories /  / MDVSA-2008:236 | Mandriva","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.openwall.com/lists/oss-security/2008/07/07/4","name":"http://www.openwall.com/lists/oss-security/2008/07/07/4","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Patch"],"title":"oss-security - Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.rdancer.org/vulnerablevim-netrw.v2.html","name":"http://www.rdancer.org/vulnerablevim-netrw.v2.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Patch","Vendor Advisory"],"title":"Arbitrary code execution in Netrw, fully patched Vim 7.2a","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/30115","name":"http://www.securityfocus.com/bid/30115","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Netrw Vim Script Multiple Command Execution Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=506919","name":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=506919","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"#506919 - vim: multiple vulnerabilities (CVE-2008-3074, CVE-2008-3075, and CVE-2008-3076) - Debian Bug report logs","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/43624","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/43624","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-3076","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-3076","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2008","cve_id":"3076","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"vim","cpe5":"vim","cpe6":"7.2a.10","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[{"cvename":"CVE-2008-3076","organization":"Red Hat","lastmodified":"2009-02-25","contributor":"Tomas Hoger","statementText":"Not vulnerable. This issue did not affect the versions of the Vim packages, as shipped with Red Hat Enterprise Linux 2.1, 3, 4, and 5. Note: This CVE is mentioned in the text of RHSA-2008:0580 (https://rhn.redhat.com/errata/RHSA-2008-0580.html), as it was originally used to track multiple issues. Issues that affected Vim packages in Red Hat Enterprise Linux 5 were later assigned separate CVE identifier - CVE-2008-6235. Neither of issues currently covered by CVE-2008-3076 (insufficient shell escaping in mz and mc commands) affected Vim packages shipped with Red Hat Enterprise Linux 5.","cve_year":"2008","cve_id":"3076","crc32":"d9bd1fa5"}],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T09:21:35.108Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"SUSE-SR:2009:007","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"],"url":"http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html"},{"name":"[oss-security] 20081016 CVE request - Vim netrw.plugin","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://marc.info/?l=oss-security&m=122416184431388&w=2"},{"name":"[oss-security] 20081020 CVE request (vim)","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://www.openwall.com/lists/oss-security/2008/10/20/2"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.rdancer.org/vulnerablevim-netrw.html"},{"name":"RHSA-2008:0580","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://www.redhat.com/support/errata/RHSA-2008-0580.html"},{"name":"34418","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/34418"},{"name":"[oss-security] 20080707 Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://www.openwall.com/lists/oss-security/2008/07/07/1"},{"name":"30115","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/30115"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.rdancer.org/vulnerablevim-netrw.v2.html"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0324"},{"name":"20080701 Re: Collection of Vulnerabilities in Fully Patched Vim 7.1","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://marc.info/?l=bugtraq&m=121494431426308&w=2"},{"name":"[oss-security] 20080708 Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://www.openwall.com/lists/oss-security/2008/07/08/12"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=506919"},{"name":"netrw-multiple-code-execution(43624)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/43624"},{"name":"[oss-security] 20080707 Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://www.openwall.com/lists/oss-security/2008/07/07/4"},{"name":"MDVSA-2008:236","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred"],"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2008:236"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2008-07-07T00:00:00.000Z","descriptions":[{"lang":"en","value":"The Netrw plugin 125 in netrw.vim in Vim 7.2a.10 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames used by the execute and system functions within the (1) mz and (2) mc commands, as demonstrated by the netrw.v2 and netrw.v3 test cases.  NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-07T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"SUSE-SR:2009:007","tags":["vendor-advisory","x_refsource_SUSE"],"url":"http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html"},{"name":"[oss-security] 20081016 CVE request - Vim netrw.plugin","tags":["mailing-list","x_refsource_MLIST"],"url":"http://marc.info/?l=oss-security&m=122416184431388&w=2"},{"name":"[oss-security] 20081020 CVE request (vim)","tags":["mailing-list","x_refsource_MLIST"],"url":"http://www.openwall.com/lists/oss-security/2008/10/20/2"},{"tags":["x_refsource_MISC"],"url":"http://www.rdancer.org/vulnerablevim-netrw.html"},{"name":"RHSA-2008:0580","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://www.redhat.com/support/errata/RHSA-2008-0580.html"},{"name":"34418","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/34418"},{"name":"[oss-security] 20080707 Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10","tags":["mailing-list","x_refsource_MLIST"],"url":"http://www.openwall.com/lists/oss-security/2008/07/07/1"},{"name":"30115","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/30115"},{"tags":["x_refsource_MISC"],"url":"http://www.rdancer.org/vulnerablevim-netrw.v2.html"},{"tags":["x_refsource_CONFIRM"],"url":"http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0324"},{"name":"20080701 Re: Collection of Vulnerabilities in Fully Patched Vim 7.1","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://marc.info/?l=bugtraq&m=121494431426308&w=2"},{"name":"[oss-security] 20080708 Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10","tags":["mailing-list","x_refsource_MLIST"],"url":"http://www.openwall.com/lists/oss-security/2008/07/08/12"},{"tags":["x_refsource_CONFIRM"],"url":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=506919"},{"name":"netrw-multiple-code-execution(43624)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/43624"},{"name":"[oss-security] 20080707 Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10","tags":["mailing-list","x_refsource_MLIST"],"url":"http://www.openwall.com/lists/oss-security/2008/07/07/4"},{"name":"MDVSA-2008:236","tags":["vendor-advisory","x_refsource_MANDRIVA"],"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2008:236"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2008-3076","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The Netrw plugin 125 in netrw.vim in Vim 7.2a.10 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames used by the execute and system functions within the (1) mz and (2) mc commands, as demonstrated by the netrw.v2 and netrw.v3 test cases.  NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"SUSE-SR:2009:007","refsource":"SUSE","url":"http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html"},{"name":"[oss-security] 20081016 CVE request - Vim netrw.plugin","refsource":"MLIST","url":"http://marc.info/?l=oss-security&m=122416184431388&w=2"},{"name":"[oss-security] 20081020 CVE request (vim)","refsource":"MLIST","url":"http://www.openwall.com/lists/oss-security/2008/10/20/2"},{"name":"http://www.rdancer.org/vulnerablevim-netrw.html","refsource":"MISC","url":"http://www.rdancer.org/vulnerablevim-netrw.html"},{"name":"RHSA-2008:0580","refsource":"REDHAT","url":"http://www.redhat.com/support/errata/RHSA-2008-0580.html"},{"name":"34418","refsource":"SECUNIA","url":"http://secunia.com/advisories/34418"},{"name":"[oss-security] 20080707 Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10","refsource":"MLIST","url":"http://www.openwall.com/lists/oss-security/2008/07/07/1"},{"name":"30115","refsource":"BID","url":"http://www.securityfocus.com/bid/30115"},{"name":"http://www.rdancer.org/vulnerablevim-netrw.v2.html","refsource":"MISC","url":"http://www.rdancer.org/vulnerablevim-netrw.v2.html"},{"name":"http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0324","refsource":"CONFIRM","url":"http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0324"},{"name":"20080701 Re: Collection of Vulnerabilities in Fully Patched Vim 7.1","refsource":"BUGTRAQ","url":"http://marc.info/?l=bugtraq&m=121494431426308&w=2"},{"name":"[oss-security] 20080708 Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10","refsource":"MLIST","url":"http://www.openwall.com/lists/oss-security/2008/07/08/12"},{"name":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=506919","refsource":"CONFIRM","url":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=506919"},{"name":"netrw-multiple-code-execution(43624)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/43624"},{"name":"[oss-security] 20080707 Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10","refsource":"MLIST","url":"http://www.openwall.com/lists/oss-security/2008/07/07/4"},{"name":"MDVSA-2008:236","refsource":"MANDRIVA","url":"http://www.mandriva.com/security/advisories?name=MDVSA-2008:236"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2008-3076","datePublished":"2009-02-21T22:00:00.000Z","dateReserved":"2008-07-08T00:00:00.000Z","dateUpdated":"2024-08-07T09:21:35.108Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2009-02-21 22:30:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-78","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:C/I:C/A:C","baseScore":9.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.6,"impactScore":10,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:vim:vim:7.2a.10:*:*:*:*:*:*:*","matchCriteriaId":"82E3ADB1-C84F-49D9-81B5-7BCA9B96A3F0"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2008","CveId":"3076","Ordinal":"1","Title":"CVE-2008-3076","CVE":"CVE-2008-3076","Year":"2008"},"notes":[{"CveYear":"2008","CveId":"3076","Ordinal":"1","NoteData":"The Netrw plugin 125 in netrw.vim in Vim 7.2a.10 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames used by the execute and system functions within the (1) mz and (2) mc commands, as demonstrated by the netrw.v2 and netrw.v3 test cases.  NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712.","Type":"Description","Title":"CVE-2008-3076"},{"CveYear":"2008","CveId":"3076","Ordinal":"2","NoteData":"2009-02-21","Type":"Other","Title":"Published"},{"CveYear":"2008","CveId":"3076","Ordinal":"3","NoteData":"2017-08-07","Type":"Other","Title":"Modified"}]}}}