vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2008-4677

N/A
Published: October 22, 2008 at 05:00 PM UTC
Updated: June 16, 2026 at 10:58 PM UTC
2 products affected across 1 vendorNetrwVim

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
N/A
Exploit prediction
EPSS 2%

Description

autoload/netrw.vim (aka the Netrw Plugin) 109, 131, and other versions before 133k for Vim 7.1.266, other 7.1 versions, and 7.2 stores credentials for an FTP session, and sends those credentials when attempting to establish subsequent FTP sessions to servers on different hosts, which allows remote FTP servers to obtain sensitive information in opportunistic circumstances by logging usernames and passwords. NOTE: the upstream vendor disputes a vector involving different ports on the same host, stating "I'm assuming that they're using the same id and password on that unchanged hostname, deliberately."

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Netrw· Vim
95%
109110111112113114115116118120121122123128131
vim-vim (environment)
Vim· Vimdevice
80%
All versions

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (15)

Mailing Listx_refsource_MLIST
Source: [email protected]
http://groups.google.com/group/vim_dev/browse_thread/thread/2f6fad581a037971/a5fcf4c4981d34e6?show_docid=a5fcf4c4981d34e6
Vendor Advisoryx_refsource_SUSE
Source: [email protected]
http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html
Third Party Advisoryx_refsource_SECUNIAVendor Advisory
Source: [email protected]
http://secunia.com/advisories/31464
Third Party Advisoryx_refsource_SECUNIA
Source: [email protected]
http://secunia.com/advisories/34418
Vendor Advisoryx_refsource_MANDRIVA
Source: [email protected]
http://www.mandriva.com/security/advisories?name=MDVSA-2008:236
Mailing Listx_refsource_MLIST
Source: [email protected]
http://www.openwall.com/lists/oss-security/2008/10/06/4
Mailing Listx_refsource_MLIST
Source: [email protected]
http://www.openwall.com/lists/oss-security/2008/10/16/2
Mailing Listx_refsource_MLIST
Source: [email protected]
http://www.openwall.com/lists/oss-security/2008/10/20/2

CVSS

4.3MEDIUM[email protected]
Confidentiality
PARTIAL
Integrity
NONE
Availability
NONE
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-255

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card