CVE-2005-2898 - NOTE: this issue has been disputed by the vendor. FileZilla 2.2.14b and 2.2.15, and possibly earlie

CVE-2005-2898

Summary

NOTE: this issue has been disputed by the vendor. FileZilla 2.2.14b and 2.2.15, and possibly earlier versions, when "Use secure mode" is disabled, uses a weak encryption scheme to store the user's password in the configuration settings file, which allows local users to obtain sensitive information. NOTE: the vendor has disputed the issue, stating that "the problem is not a vulnerability at all, but in fact a fundamental issue of every single program that can store passwords transparently.

References

Vulnerable Configurations

cpe:2.3:a:filezilla:filezilla:2.2.15:*:*:*:*:*:*:*
cpe:2.3:a:filezilla:filezilla:2.2.15:*:*:*:*:*:*:*
cpe:2.3:a:filezilla:filezilla:2.2.14b:*:*:*:*:*:*:*
cpe:2.3:a:filezilla:filezilla:2.2.14b:*:*:*:*:*:*:*

CVSS

Base:	4.6 (as of 07-08-2024 - 23:15)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
LOCAL	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:L/AC:L/Au:N/C:P/I:P/A:P

refmap via4

bid	14730
bugtraq	20050902 FileZilla weakly-encrypted password vulnerability: advisory + PoC 20050904 Re: FileZilla weakly-encrypted password vulnerability: advisory + PoC
misc	http://filezilla.sourceforge.net/forum/viewtopic.php?t=1328
xf	filezilla-password-weak-encryption(22135)

Last major update

07-08-2024 - 23:15

Published

14-09-2005 - 20:03

Last modified

07-08-2024 - 23:15