CVE-2008-4677
autoload/netrw.vim (aka the Netrw Plugin) 109, 131, and other versions before 133k for Vim 7.1.266, other 7.1 versions, and 7.2 stores…
- Published
- Updated
- Reserved
- Assigned by
- mitre
Description
autoload/netrw.vim (aka the Netrw Plugin) 109, 131, and other versions before 133k for Vim 7.1.266, other 7.1 versions, and 7.2 stores credentials for an FTP session, and sends those credentials when attempting to establish subsequent FTP sessions to servers on different hosts, which allows remote FTP servers to obtain sensitive information in opportunistic circumstances by logging usernames and passwords. NOTE: the upstream vendor disputes a vector involving different ports on the same host, stating "I'm assuming that they're using the same id and password on that unchanged hostname, deliberately."
Timeline
ID reserved
By mitre
Published
- 16 years later
· 16 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 2.0 | Medium4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N |
- EPSS (exploitation in 30 days)
- 2.0% · top 20% of all CVEs (9 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.
Weakness
Affected products
n/a
- affected n/a
References (15)
- 30670 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
- SUSE-SR:2009:007 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
- 31464 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- https://bugzilla.redhat.com/show_bug.cgi?id=461750 (opens in a new tab)x_refsource_CONFIRMx_transferred
- [vim_dev] 20080817 Re: Anyone fixing SA31464? (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [oss-security] 20081020 CVE request (vim) (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [oss-security] 20081016 CVE request - Vim netrw.plugin (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- 20080812 Vim: Netrw: FTP User Name and Password Disclosure (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
- ADV-2008-2379 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
- 34418 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- [oss-security] 20081006 CVE request - (vim : netrw plugin - ftp user credentials disclosure) (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- 20080812 Re: Vim: Netrw: FTP User Name and Password Disclosure (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
- MDVSA-2008:236 (opens in a new tab)vendor-advisoryx_refsource_MANDRIVAx_transferred
- http://www.rdancer.org/vulnerablevim-netrw-credentials-dis.html (opens in a new tab)x_refsource_MISCx_transferred
- vim-netrw-ftp-information-disclosure(44419) (opens in a new tab)vdb-entryx_refsource_XFx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2008-4657 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2008-4677)Record last updated .