Vulnerability Details : CVE-2008-4677

autoload/netrw.vim (aka the Netrw Plugin) 109, 131, and other versions before 133k for Vim 7.1.266, other 7.1 versions, and 7.2 stores credentials for an FTP session, and sends those credentials when attempting to establish subsequent FTP sessions to servers on different hosts, which allows remote FTP servers to obtain sensitive information in opportunistic circumstances by logging usernames and passwords. NOTE: the upstream vendor disputes a vector involving different ports on the same host, stating "I'm assuming that they're using the same id and password on that unchanged hostname, deliberately."
Published 2008-10-22 18:00:01
Updated 2017-08-08 01:32:50
Source MITRE
View at NVD,   CVE.org

Products affected by CVE-2008-4677

  • VIM » Netrw » Version: 109
    cpe:2.3:a:vim:netrw:109:*:*:*:*:*:*:*
    Matching versions
    When used together with: VIM » VIM » Version: 7.1
    When used together with: VIM » VIM » Version: 7.1.266
    When used together with: VIM » VIM » Version: 7.2
  • VIM » Netrw » Version: 131
    cpe:2.3:a:vim:netrw:131:*:*:*:*:*:*:*
    Matching versions
    When used together with: VIM » VIM » Version: 7.1
    When used together with: VIM » VIM » Version: 7.1.266
    When used together with: VIM » VIM » Version: 7.2
  • VIM » Netrw » Version: 116
    cpe:2.3:a:vim:netrw:116:*:*:*:*:*:*:*
    Matching versions
    When used together with: VIM » VIM » Version: 7.1
    When used together with: VIM » VIM » Version: 7.1.266
    When used together with: VIM » VIM » Version: 7.2
  • VIM » Netrw » Version: 118
    cpe:2.3:a:vim:netrw:118:*:*:*:*:*:*:*
    Matching versions
    When used together with: VIM » VIM » Version: 7.1
    When used together with: VIM » VIM » Version: 7.1.266
    When used together with: VIM » VIM » Version: 7.2
  • VIM » Netrw » Version: 112
    cpe:2.3:a:vim:netrw:112:*:*:*:*:*:*:*
    Matching versions
    When used together with: VIM » VIM » Version: 7.1
    When used together with: VIM » VIM » Version: 7.1.266
    When used together with: VIM » VIM » Version: 7.2
  • VIM » Netrw » Version: 113
    cpe:2.3:a:vim:netrw:113:*:*:*:*:*:*:*
    Matching versions
    When used together with: VIM » VIM » Version: 7.1
    When used together with: VIM » VIM » Version: 7.1.266
    When used together with: VIM » VIM » Version: 7.2
  • VIM » Netrw » Version: 122
    cpe:2.3:a:vim:netrw:122:*:*:*:*:*:*:*
    Matching versions
    When used together with: VIM » VIM » Version: 7.1
    When used together with: VIM » VIM » Version: 7.1.266
    When used together with: VIM » VIM » Version: 7.2
  • VIM » Netrw » Version: 123
    cpe:2.3:a:vim:netrw:123:*:*:*:*:*:*:*
    Matching versions
    When used together with: VIM » VIM » Version: 7.1
    When used together with: VIM » VIM » Version: 7.1.266
    When used together with: VIM » VIM » Version: 7.2
  • VIM » Netrw » Version: 114
    cpe:2.3:a:vim:netrw:114:*:*:*:*:*:*:*
    Matching versions
    When used together with: VIM » VIM » Version: 7.1
    When used together with: VIM » VIM » Version: 7.1.266
    When used together with: VIM » VIM » Version: 7.2
  • VIM » Netrw » Version: 115
    cpe:2.3:a:vim:netrw:115:*:*:*:*:*:*:*
    Matching versions
    When used together with: VIM » VIM » Version: 7.1
    When used together with: VIM » VIM » Version: 7.1.266
    When used together with: VIM » VIM » Version: 7.2
  • VIM » Netrw » Version: 128
    cpe:2.3:a:vim:netrw:128:*:*:*:*:*:*:*
    Matching versions
    When used together with: VIM » VIM » Version: 7.1
    When used together with: VIM » VIM » Version: 7.1.266
    When used together with: VIM » VIM » Version: 7.2
  • VIM » Netrw » Version: 110
    cpe:2.3:a:vim:netrw:110:*:*:*:*:*:*:*
    Matching versions
    When used together with: VIM » VIM » Version: 7.1
    When used together with: VIM » VIM » Version: 7.1.266
    When used together with: VIM » VIM » Version: 7.2
  • VIM » Netrw » Version: 111
    cpe:2.3:a:vim:netrw:111:*:*:*:*:*:*:*
    Matching versions
    When used together with: VIM » VIM » Version: 7.1
    When used together with: VIM » VIM » Version: 7.1.266
    When used together with: VIM » VIM » Version: 7.2
  • VIM » Netrw » Version: 120
    cpe:2.3:a:vim:netrw:120:*:*:*:*:*:*:*
    Matching versions
    When used together with: VIM » VIM » Version: 7.1
    When used together with: VIM » VIM » Version: 7.1.266
    When used together with: VIM » VIM » Version: 7.2
  • VIM » Netrw » Version: 121
    cpe:2.3:a:vim:netrw:121:*:*:*:*:*:*:*
    Matching versions
    When used together with: VIM » VIM » Version: 7.1
    When used together with: VIM » VIM » Version: 7.1.266
    When used together with: VIM » VIM » Version: 7.2

Exploit prediction scoring system (EPSS) score for CVE-2008-4677

EPSS FAQ
0.93%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 74 %
Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2008-4677

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
4.3
 MEDIUM AV:N/AC:M/Au:N/C:P/I:N/A:N
8.6
2.9
 NIST

CWE ids for CVE-2008-4677

  • Assigned by: nvd@nist.gov (Primary)

Vendor statements for CVE-2008-4677

  • Red Hat 2008-10-25
    Not vulnerable. This issue did not affect the versions of vim as shipped with Red Hat Enterprise Linux 2.1, 3, 4, or 5.

References for CVE-2008-4677

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close