CVE-2008-4677

Name: CVE-2008-4677
Creator: NVD / NIST
Published: 2008-10-22T18:00:00.91+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 1.95%

Last modified Jun 16, 2026

CVE-2008-4677 is a vulnerability of currently unknown severity. autoload/netrw.vim (aka the Netrw Plugin) 109, 131, and other versions before 133k for Vim 7.1.266, other 7.1 versions, and 7.2 stores credentials for an FTP session, and sends those credentials when attempting to establish subsequent FTP sessions to servers on different hosts, which allows remote FTP servers to obtain sensitive information in opportunistic circumstances by logging usernames and passwords. NOTE: the upstream vendor disputes a vector involving different ports on the same host, stating "I'm assuming that they're using the same id and password on that unchanged hostname, deliberately.". EPSS estimates a 1.95% chance of exploitation in the next 30 days.

Description

autoload/netrw.vim (aka the Netrw Plugin) 109, 131, and other versions before 133k for Vim 7.1.266, other 7.1 versions, and 7.2 stores credentials for an FTP session, and sends those credentials when attempting to establish subsequent FTP sessions to servers on different hosts, which allows remote FTP servers to obtain sensitive information in opportunistic circumstances by logging usernames and passwords. NOTE: the upstream vendor disputes a vector involving different ports on the same host, stating "I'm assuming that they're using the same id and password on that unchanged hostname, deliberately."

Metrics

EPSS Probability

1.95%

77.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-255

Affected Software

Vendor	Product	Versions
Vim	Netrw	109
Vim	Netrw	110
Vim	Netrw	111
Vim	Netrw	112
Vim	Netrw	113
Vim	Netrw	114
Vim	Netrw	115
Vim	Netrw	116
Vim	Netrw	118
Vim	Netrw	120
Vim	Netrw	121
Vim	Netrw	122
Vim	Netrw	123
Vim	Netrw	128
Vim	Netrw	131

References

Timeline

Published: Oct 22, 2008
Last Modified: Jun 16, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2008-4677?

How severe is CVE-2008-4677?

Severity scoring for CVE-2008-4677 is pending analysis. The EPSS model estimates a 1.95% probability of exploitation in the next 30 days.

How do I fix CVE-2008-4677?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2008-4677?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST