CVE-2008-4677

🗓️ 22 Oct 2008 17:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 61 Views🌐 WEB

autoload/netrw.vim (aka the Netrw Plugin) before 133k for Vim 7.1.266 stores FTP credentials, exposing sensitive information

Reporter	Title	Published	Views	Family All 24
Information Security Automation	Scanvus now supports Vulners and Vulns.io VM Linux vulnerability detection APIs	30 Dec 202218:03	–	avleonov
Cvelist	CVE-2008-4677	22 Oct 200817:00	–	cvelist
Debian CVE	CVE-2008-4677	22 Oct 200817:00	–	debiancve
EUVD	EUVD-2008-4657	7 Oct 202500:30	–	euvd
Tenable Nessus	Mandriva Linux Security Advisory : vim (MDVSA-2008:236-1)	23 Apr 200900:00	–	nessus
Tenable Nessus	SuSE9 Security Update : ViM (YOU Patch Number 12360)	24 Sep 200900:00	–	nessus
Tenable Nessus	openSUSE Security Update : gvim (gvim-561)	21 Jul 200900:00	–	nessus
Tenable Nessus	openSUSE Security Update : gvim (gvim-561)	21 Jul 200900:00	–	nessus
Tenable Nessus	openSUSE 10 Security Update : gvim (gvim-6023)	13 Mar 200900:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2008-4677	24 Aug 202500:00	–	nessus

NVD

Node

AND

vim vimMatch7.1

vim vimMatch7.1.266

vim vimMatch7.2

vim netrwMatch109

vim netrwMatch110

vim netrwMatch111

vim netrwMatch112

vim netrwMatch113

vim netrwMatch114

vim netrwMatch115

vim netrwMatch116

vim netrwMatch118

vim netrwMatch120

vim netrwMatch121

vim netrwMatch122

vim netrwMatch123

vim netrwMatch128

vim netrwMatch131

Source	Link
secunia	www.secunia.com/advisories/34418
rdancer	www.rdancer.org/vulnerablevim-netrw-credentials-dis.html
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/44419
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
openwall	www.openwall.com/lists/oss-security/2008/10/06/4
mandriva	www.mandriva.com/security/advisories
secunia	www.secunia.com/advisories/31464
lists	www.lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html
groups	www.groups.google.com/group/vim_dev/browse_thread/thread/2f6fad581a037971/a5fcf4c4981d34e6
securityfocus	www.securityfocus.com/archive/1/495432

Parameter	Position	Path	Description	CWE
username	path	autoload/netrw.vim	Netrw Vim plugin stores FTP credentials and transmits them during subsequent FTP sessions to different hosts, potentially leaking usernames and passwords.	CWE-255
password	path	autoload/netrw.vim	Netrw Vim plugin stores FTP credentials and transmits them during subsequent FTP sessions to different hosts, potentially leaking usernames and passwords.	CWE-255

16 Jun 2026 22:58Current

8High risk

Vulners AI Score8

CVSS 24.3

EPSS0.01953