vulnwire
9.3crit

CVE-2008-30761 exploit

The Netrw plugin 125 in netrw.vim in Vim 7.2a.10 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filen…

Published 17 y ago · modified 4 mo ago · JSON

CVSS
9.3
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
9.0%
percentile 95%
Public exploits
1
Exploit-DB

The Netrw plugin 125 in netrw.vim in Vim 7.2a.10 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames used by the execute and system functions within the (1) mz and (2) mc commands, as demonstrated by the netrw.v2 and netrw.v3 test cases. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712.

Exploit prediction (EPSS)

9.02% probability of exploitation in the next 30 days, higher than 95% of all scored CVEs.

Exploits and detections

  • EDB-32012 Netrw 125 Vim Script - Multiple Command Execution Vulnerabilities · remote · 2008-07-07

CVSS scores

Assigned byVersionScoreVector
NVD2.09.3AV:N/AC:M/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

  • lists.opensuse.org /opensuse-security-announce/2009-03/msg00004.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • marc.info /?l=oss-security&m=122416184431388&w=2 · mailing-list, x_refsource_MLIST, x_transferred
  • openwall.com /lists/oss-security/2008/10/20/2 · mailing-list, x_refsource_MLIST, x_transferred
  • rdancer.org /vulnerablevim-netrw.html · x_refsource_MISC, x_transferred
  • redhat.com /support/errata/RHSA-2008-0580.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • secunia.com /advisories/34418 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • openwall.com /lists/oss-security/2008/07/07/1 · mailing-list, x_refsource_MLIST, x_transferred
  • securityfocus.com /bid/30115 · vdb-entry, x_refsource_BID, x_transferred
  • rdancer.org /vulnerablevim-netrw.v2.html · x_refsource_MISC, x_transferred
  • wiki.rpath.com /wiki/Advisories:rPSA-2008-0324 · x_refsource_CONFIRM, x_transferred
  • marc.info /?l=bugtraq&m=121494431426308&w=2 · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • openwall.com /lists/oss-security/2008/07/08/12 · mailing-list, x_refsource_MLIST, x_transferred
  • bugs.debian.org /cgi-bin/bugreport.cgi?bug=506919 · x_refsource_CONFIRM, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/43624 · vdb-entry, x_refsource_XF, x_transferred
  • openwall.com /lists/oss-security/2008/07/07/4 · mailing-list, x_refsource_MLIST, x_transferred
  • mandriva.com /security/advisories?name=MDVSA-2008:236 · vendor-advisory, x_refsource_MANDRIVA, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.