autoload/netrw.vim (aka the Netrw Plugin) 109, 131, and other versions before 133k for Vim 7.1.266, other 7.1 versions, and 7.2 stores cred…

published 2008-10-22 18 y ago modified 2026-06-16 4 mo ago also EUVD-2008-4657

cvss: 4.3; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 2.0%; EPSS 2.0% chance of exploitation in 30 days, percentile 80%
public exploits: 0; none known

autoload/netrw.vim (aka the Netrw Plugin) 109, 131, and other versions before 133k for Vim 7.1.266, other 7.1 versions, and 7.2 stores credentials for an FTP session, and sends those credentials when attempting to establish subsequent FTP sessions to servers on different hosts, which allows remote FTP servers to obtain sensitive information in opportunistic circumstances by logging usernames and passwords. NOTE: the upstream vendor disputes a vector involving different ports on the same host, stating "I'm assuming that they're using the same id and password on that unchanged hostname, deliberately."

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2008-4677 updated 2025-11-21

vim: netrw plugin: FTP username and password disclosure

Red Hat All currently supported Red Hat products
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.95% chance of exploitation in the next 30 days, higher than 80% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	2.0	4.3	AV:N/AC:M/Au:N/C:P/I:N/A:N

Classification

Weakness

CWE-255 Credentials Management Errors

References

lists.opensuse.org /opensuse-security-announce/2009-03/msg00004.html
vendor-advisory
mandriva.com /security/advisories?name=MDVSA-2008:236
vendor-advisory
secunia.com /advisories/31464
third-party-advisory, vendor-advisory
securityfocus.com /bid/30670
vdb-entry
bugzilla.redhat.com /show_bug.cgi?id=461750
groups.google.com /group/vim_dev/browse_thread/thread/2f6fad581a037971/a5fcf4c4981d34e6?show_docid=a5fcf4c4981d34e6
mailing-list
openwall.com /lists/oss-security/2008/10/20/2
mailing-list
openwall.com /lists/oss-security/2008/10/16/2
mailing-list
securityfocus.com /archive/1/495436
mailing-list
vupen.com /english/advisories/2008/2379
vdb-entry
secunia.com /advisories/34418
third-party-advisory
openwall.com /lists/oss-security/2008/10/06/4
mailing-list
securityfocus.com /archive/1/495432
mailing-list
rdancer.org /vulnerablevim-netrw-credentials-dis.html
exchange.xforce.ibmcloud.com /vulnerabilities/44419
vdb-entry

Sources

CVE List CVE-2008-4677
NVD CVE-2008-4677

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary