CVE-2004-1948 Information disclosure in n/a
Local attackers can read FTP credentials from the process list when users pass them via command-line URLs in NcFTP.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2004-1948?
CVE-2004-1948 is a medium-severity vulnerability in n/a, published on 10 May 2005. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
NcFTP client 3.1.6 and 3.1.7, when the username and password are included in an FTP URL that is provided on the command line, allows local users to obtain sensitive information via "ps aux," which displays the URL in the process list.
Which versions are affected by CVE-2004-1948?
It affects 1 product.
Products include Ncftp Software Ncftp.
How do I fix CVE-2004-1948?
Upgrade to a fixed version.
Is CVE-2004-1948 being exploited?
There is no known exploitation of CVE-2004-1948 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2004-1948, GHSA-9ww4-42mh-q457.