CVEvulnerability

CVE-2004-1948

4.6 MEDIUM Published 2004-04-20 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2004-04-20
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.6 MEDIUM — AV:L/AC:L/Au:N/C:P/I:P/A:P

Description

NcFTP client 3.1.6 and 3.1.7, when the username and password are included in an FTP URL that is provided on the command line, allows local users to obtain sensitive information via "ps aux," which displays the URL in the process list.

Affected configurations

• ncftp software ncftp 3.0.0 • ncftp software ncftp 3.0.1 • ncftp software ncftp 3.0.2 • ncftp software ncftp 3.0.3 • ncftp software ncftp 3.0.4 • ncftp software ncftp 3.1.0 • ncftp software ncftp 3.1.1 • ncftp software ncftp 3.1.2 • ncftp software ncftp 3.1.3 • ncftp software ncftp 3.1.4 • ncftp software ncftp 3.1.5 • ncftp software ncftp 3.1.6 • ncftp software ncftp 3.1.7

Related

Referenced by CWE · observed example (1)

  • CWE-214 Invocation of Process Using Visible Sensitive Information weakness

References