CVE-2008-4677
autoload/netrw.vim (aka the Netrw Plugin) 109, 131, and other versions before 133k for Vim 7.1.266, other 7.1 versions, and 7.2 stores credentials for an FTP session, and sends those credentials when attempting to establish subsequent FTP sessions to servers on different hosts, which allows remote FTP servers to obtain sensitive information in opportunistic circumstances by logging usernames and passwords. NOTE: the upstream vendor disputes a vector involving different ports on the same host, stating "I'm assuming that they're using the same id and password on that unchanged hostname, deliberately."
Key facts
- CVSS score
- 4.3 (v2.0)
- Severity
- MEDIUM
- CVSS vector
AV:N/AC:M/Au:N/C:P/I:N/A:N- Weakness (CWE)
- CWE-255
- EPSS score
- 2.0% (80th percentile)
- In CISA KEV
- No
- In EU EUVD
- Yes (EUVD-2008-4657)
- Published
- October 22, 2008
- NVD last modified
- June 16, 2026
- Status
- Modified
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2008-4657 in the EU Vulnerability Database. Last updated in EUVD on August 7, 2024.
View on the EU Vulnerability DatabaseAffected products
- vim / netrw
- vim / netrw
- vim / netrw
- vim / netrw
- vim / netrw
- vim / netrw
- vim / netrw
- vim / netrw
- vim / netrw
- vim / netrw
- vim / netrw
- vim / netrw
- vim / netrw
- vim / netrw
- vim / netrw
- vim / vim
- vim / vim
- vim / vim
References
- http://groups.google.com/group/vim_dev/browse_thread/thread/2f6fad581a037971/a5fcf4c4981d34e6?show_docid=a5fcf4c4981d34e6
- http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html
- http://secunia.com/advisories/31464(Vendor Advisory)
- http://secunia.com/advisories/34418
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:236
- http://www.openwall.com/lists/oss-security/2008/10/06/4
- http://www.openwall.com/lists/oss-security/2008/10/16/2
- http://www.openwall.com/lists/oss-security/2008/10/20/2
- http://www.rdancer.org/vulnerablevim-netrw-credentials-dis.html
- http://www.securityfocus.com/archive/1/495432
- http://www.securityfocus.com/archive/1/495436
- http://www.securityfocus.com/bid/30670
- http://www.vupen.com/english/advisories/2008/2379
- https://bugzilla.redhat.com/show_bug.cgi?id=461750
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44419
Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain