Unscored severity · published Apr 20, 2004
CVE-2004-1948
NcFTP client 3.1.6 and 3.1.7, when the username and password are included in an FTP URL that is provided on the command line, allows local users to obtain sensitive information…
–
CVSS
0.5%
EPSS
No
On KEV
Description
NcFTP client 3.1.6 and 3.1.7, when the username and password are included in an FTP URL that is provided on the command line, allows local users to obtain sensitive information via "ps aux," which displays the URL in the process list.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NC
Ncftp · Ncftp Software
3.0.0; 3.0.1; 3.0.2; 3.0.3; 3.0.4; 3.1.0; +7 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-1948
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-1948
marc.info
http://marc.info/?l=bugtraq&m=108247943201685&w=2
Exploit
http://secunia.com/advisories/11438
www.osvdb.org
http://www.osvdb.org/5595
Vendor Advisory
http://www.securityfocus.com/bid/10182
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/15919
More from Ncftp
–
CVE-2002-1345
Directory traversal vulnerabilities in multiple FTP clients on UNIX systems allow remote malicious FTP servers to create or overwrite files as the client user via filenames…