autoload/netrw.vim (aka the Netrw Plugin) 109, 131, and other versions before 133k for…
Priority LOW 24CWE-255Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- —
- Confidentiality · integrity · availability
- Partial · None · None
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
autoload/netrw.vim (aka the Netrw Plugin) 109, 131, and other versions before 133k for Vim 7.1.266, other 7.1 versions, and 7.2 stores credentials for an FTP session, and sends those credentials when attempting to establish subsequent FTP sessions to servers on different hosts, which allows remote FTP servers to obtain sensitive information in opportunistic circumstances by logging usernames and passwords. NOTE: the upstream vendor disputes a vector involving different ports on the same host, stating "I'm assuming that they're using the same id and password on that unchanged hostname, deliberately."
Why it matters now
EPSS 0.01953 80th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 18
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vim:vim:7.1:*:*:*:*:*:*:* | 7.1 | Running on | vim |
| cpe:2.3:a:vim:vim:7.1.266:*:*:*:*:*:*:* | 7.1.266 | Running on | vim |
| cpe:2.3:a:vim:vim:7.2:*:*:*:*:*:*:* | 7.2 | Running on | vim |
| cpe:2.3:a:vim:netrw:109:*:*:*:*:*:*:* | 109 | Vulnerable | vim |
| cpe:2.3:a:vim:netrw:110:*:*:*:*:*:*:* | 110 | Vulnerable | vim |
| cpe:2.3:a:vim:netrw:111:*:*:*:*:*:*:* | 111 | Vulnerable | vim |
| cpe:2.3:a:vim:netrw:112:*:*:*:*:*:*:* | 112 | Vulnerable | vim |
| cpe:2.3:a:vim:netrw:113:*:*:*:*:*:*:* | 113 | Vulnerable | vim |
| cpe:2.3:a:vim:netrw:114:*:*:*:*:*:*:* | 114 | Vulnerable | vim |
| cpe:2.3:a:vim:netrw:115:*:*:*:*:*:*:* | 115 | Vulnerable | vim |
- cpe:2.3:a:vim:vim:7.1:*:*:*:*:*:*:* Versions 7.1 Running on ·vim
- cpe:2.3:a:vim:vim:7.1.266:*:*:*:*:*:*:* Versions 7.1.266 Running on ·vim
- cpe:2.3:a:vim:vim:7.2:*:*:*:*:*:*:* Versions 7.2 Running on ·vim
- cpe:2.3:a:vim:netrw:109:*:*:*:*:*:*:* Versions 109 Vulnerable ·vim
- cpe:2.3:a:vim:netrw:110:*:*:*:*:*:*:* Versions 110 Vulnerable ·vim
- cpe:2.3:a:vim:netrw:111:*:*:*:*:*:*:* Versions 111 Vulnerable ·vim
- cpe:2.3:a:vim:netrw:112:*:*:*:*:*:*:* Versions 112 Vulnerable ·vim
- cpe:2.3:a:vim:netrw:113:*:*:*:*:*:*:* Versions 113 Vulnerable ·vim
- cpe:2.3:a:vim:netrw:114:*:*:*:*:*:*:* Versions 114 Vulnerable ·vim
- cpe:2.3:a:vim:netrw:115:*:*:*:*:*:*:* Versions 115 Vulnerable ·vim
Show 8 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vim:netrw:116:*:*:*:*:*:*:* | 116 | Vulnerable | vim |
| cpe:2.3:a:vim:netrw:118:*:*:*:*:*:*:* | 118 | Vulnerable | vim |
| cpe:2.3:a:vim:netrw:120:*:*:*:*:*:*:* | 120 | Vulnerable | vim |
| cpe:2.3:a:vim:netrw:121:*:*:*:*:*:*:* | 121 | Vulnerable | vim |
| cpe:2.3:a:vim:netrw:122:*:*:*:*:*:*:* | 122 | Vulnerable | vim |
| cpe:2.3:a:vim:netrw:123:*:*:*:*:*:*:* | 123 | Vulnerable | vim |
| cpe:2.3:a:vim:netrw:128:*:*:*:*:*:*:* | 128 | Vulnerable | vim |
| cpe:2.3:a:vim:netrw:131:*:*:*:*:*:*:* | 131 | Vulnerable | vim |
- cpe:2.3:a:vim:netrw:116:*:*:*:*:*:*:* Versions 116 Vulnerable ·vim
- cpe:2.3:a:vim:netrw:118:*:*:*:*:*:*:* Versions 118 Vulnerable ·vim
- cpe:2.3:a:vim:netrw:120:*:*:*:*:*:*:* Versions 120 Vulnerable ·vim
- cpe:2.3:a:vim:netrw:121:*:*:*:*:*:*:* Versions 121 Vulnerable ·vim
- cpe:2.3:a:vim:netrw:122:*:*:*:*:*:*:* Versions 122 Vulnerable ·vim
- cpe:2.3:a:vim:netrw:123:*:*:*:*:*:*:* Versions 123 Vulnerable ·vim
- cpe:2.3:a:vim:netrw:128:*:*:*:*:*:*:* Versions 128 Vulnerable ·vim
- cpe:2.3:a:vim:netrw:131:*:*:*:*:*:*:* Versions 131 Vulnerable ·vim
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2008-4677
- 2026-10-03 Alias added: GHSA-q2qw-7ccw-vchv
References
Advisory 2
Other 7
- https://bugzilla.redhat.com/show_bug.cgi?id=461750
- [vim_dev] 20080817 Re: Anyone fixing SA31464?
- [oss-security] 20081020 CVE request (vim)
- [oss-security] 20081016 CVE request - Vim netrw.plugin
- ADV-2008-2379
- [oss-security] 20081006 CVE request - (vim : netrw plugin - ftp user credentials disclosure)
- http://www.rdancer.org/vulnerablevim-netrw-credentials-dis.html
Sources
- CVE-2008-4677 · CVE Program
- CVE-2008-4677 · NVD
- FIRST EPSS
- GHSA-q2qw-7ccw-vchv · GitHub Advisory Database · CC BY 4.0
- CVE-2008-4677 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences