Approved changes feed: RSS · Atom
cpe:2.3:a:vim:netrw:120:*:*:*:*:*:*:*
part: a version: 120 update: *
| Vendor | Vim (716ce8b1-7979-5675-a269-d795f6319d34) |
|---|---|
| Product | Netrw (bedaaf88-2980-5de3-8da6-f070323af7a8) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2008-4677 |
vulnerable | 2026-06-08 04:50:47.603992 |
Details available
autoload/netrw.vim (aka the Netrw Plugin) 109, 131, and other versions before 133k for Vim 7.1.266, other 7.1 versions, and 7.2 stores credentials for an FTP session, and sends those credentials when attempting to establish subsequent FTP sessions to servers on different hosts, which allows remote FTP servers to obtain sensitive information in opportunistic circumstances by logging usernames and passwords. NOTE: the upstream vendor disputes a vector involving different ports on the same host, stating "I'm assuming that they're using the same id and password on that unchanged hostname, deliberately."
Published: 2008-10-22T17:00:00.000Z
Updated: 2024-08-07T10:24:21.072Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.