NVD

Id
4491  
Name
CVE-2008-4677  
Description
autoload/netrw.vim (aka the Netrw Plugin) 109, 131, and other versions before 133k for Vim 7.1.266, other 7.1 versions, and 7.2 stores credentials for an FTP session, and sends those credentials when attempting to establish subsequent FTP sessions to servers on different hosts, which allows remote FTP servers to obtain sensitive information in opportunistic circumstances by logging usernames and passwords. NOTE: the upstream vendor disputes a vector involving different ports on the same host, stating "I"m assuming that they"re using the same id and password on that unchanged hostname, deliberately."  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-03  
Published
2008-10-22  
Modified Date
2009-04-01  
Seq
2008-4677  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
28221 4491 CVE-2008-4677 [vim_dev] 20080817 Re: Anyone fixing SA31464?  View
28222 4491 CVE-2008-4677 SUSE-SR:2009:007  View
28223 4491 CVE-2008-4677 MDVSA-2008:236  View
28224 4491 CVE-2008-4677 [oss-security] 20081006 CVE request - (vim : netrw plugin - ftp user credentials disclosure)  View
28225 4491 CVE-2008-4677 [oss-security] 20081016 CVE request - Vim netrw.plugin  View
28226 4491 CVE-2008-4677 [oss-security] 20081020 CVE request (vim)  View
28227 4491 CVE-2008-4677 http://www.rdancer.org/vulnerablevim-netrw-credentials-dis.html  View
28228 4491 CVE-2008-4677 20080812 Re: Vim: Netrw: FTP User Name and Password Disclosure  View
28229 4491 CVE-2008-4677 20080812 Vim: Netrw: FTP User Name and Password Disclosure  View
28230 4491 CVE-2008-4677 30670  View
28231 4491 CVE-2008-4677 ADV-2008-2379  View
28232 4491 CVE-2008-4677 vim-netrw-ftp-information-disclosure(44419)  View
28233 4491 CVE-2008-4677 https://bugzilla.redhat.com/show_bug.cgi?id=461750  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
51036 JVNDB-2008-006346 Vim 用の autoload/netrw.vim における重要な情報を取得される脆弱性 Vim 用の autoload/netrw.vim は、他ホスト上のサーバに対して連続で FTP セッション確立が試行されている際、FTP セッションへの資格情報を格納する、および資格情報を送信するため、重要な情報を取得される脆弱性が存在します。 CVE-2008-4677 34790 CVE-2008-4677 4491 4.3 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-006346.html 2008-10-22 2012-12-20 View