CVE-2007-5201 - Vulnerability Details - OpenCVE

Description

The FTP backend for Duplicity before 0.4.9 sends the password as a command line argument when calling ncftp, which might allow local users to read the password by listing the process and its arguments.

Published: 2007-10-04

Score: 4.6 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

No analysis available yet.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

n/a

affected

Version	Status	Constraints
`n/a`	affected	—

Configuration 1 [-]

cpe:2.3:a:duplicity_project:duplicity:*:*:*:*:*:*:*:*

No data.

No data available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2022-5669	The FTP backend for Duplicity before 0.4.9 sends the password as a command line argument when calling ncftp, which might allow local users to read the password by listing the process and its arguments.
Github GHSA	GHSA-wxcw-rqxc-hj85	FTP backend for Duplicity Discloses Passwords to Process Listing

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00371.

Key SSVC decision points have not yet been added.

References

Link	Providers
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=442840
http://duplicity.nongnu.org/CHANGELOG
http://osvdb.org/42339
http://secunia.com/advisories/28917
http://www.securityfocus.com/bid/27771
https://bugzilla.redhat.com/show_bug.cgi?id=293081
https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00356.html
https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00445.html

History

No history.

Subscriptions

Duplicity Project Duplicity

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2007-10-04T17:00:00.000Z

Updated: 2024-08-07T15:24:42.430Z

Reserved: 2007-10-04T00:00:00.000Z

Link: CVE-2007-5201

Vulnrichment

No data.

NVD

Status : Modified

Published: 2007-10-04T17:17:00.000

Modified: 2026-06-16T22:45:38.680

Link: CVE-2007-5201

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-200
Exposure of Sensitive Information to an Unauthorized Actor

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2007-09-19T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "The FTP backend for Duplicity before 0.4.9 sends the password as a command line argument when calling ncftp, which might allow local users to read the password by listing the process and its arguments."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2008-02-19T10:00:00.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=442840"}, {"name": "27771", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/27771"}, {"name": "FEDORA-2008-1521", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00356.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=293081"}, {"name": "28917", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/28917"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://duplicity.nongnu.org/CHANGELOG"}, {"name": "42339", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/42339"}, {"name": "FEDORA-2008-1584", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00445.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2007-5201", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The FTP backend for Duplicity before 0.4.9 sends the password as a command line argument when calling ncftp, which might allow local users to read the password by listing the process and its arguments."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=442840", "refsource": "CONFIRM", "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=442840"}, {"name": "27771", "refsource": "BID", "url": "http://www.securityfocus.com/bid/27771"}, {"name": "FEDORA-2008-1521", "refsource": "FEDORA", "url": "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00356.html"}, {"name": "https://bugzilla.redhat.com/show_bug.cgi?id=293081", "refsource": "CONFIRM", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=293081"}, {"name": "28917", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/28917"}, {"name": "http://duplicity.nongnu.org/CHANGELOG", "refsource": "CONFIRM", "url": "http://duplicity.nongnu.org/CHANGELOG"}, {"name": "42339", "refsource": "OSVDB", "url": "http://osvdb.org/42339"}, {"name": "FEDORA-2008-1584", "refsource": "FEDORA", "url": "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00445.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T15:24:42.430Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=442840"}, {"name": "27771", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/27771"}, {"name": "FEDORA-2008-1521", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00356.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=293081"}, {"name": "28917", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/28917"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://duplicity.nongnu.org/CHANGELOG"}, {"name": "42339", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/42339"}, {"name": "FEDORA-2008-1584", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00445.html"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2007-5201", "datePublished": "2007-10-04T17:00:00.000Z", "dateReserved": "2007-10-04T00:00:00.000Z", "dateUpdated": "2024-08-07T15:24:42.430Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:duplicity_project:duplicity:*:*:*:*:*:*:*:*", "matchCriteriaId": "9DA591CA-0E11-4A62-9CF5-090AF11FE167", "versionEndExcluding": "0.4.9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The FTP backend for Duplicity before 0.4.9 sends the password as a command line argument when calling ncftp, which might allow local users to read the password by listing the process and its arguments."}, {"lang": "es", "value": "El backend FTP para Duplicity versiones anteriores a 0.4.9, env\u00eda la contrase\u00f1a como un argumento de la l\u00ednea de comandos cuando se llama a ncftp, lo que podr\u00eda permitir a usuarios locales leer la contrase\u00f1a mediante la enumeraci\u00f3n de los procesos y sus argumentos."}], "id": "CVE-2007-5201", "lastModified": "2026-06-16T22:45:38.680", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2007-10-04T17:17:00.000", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=442840"}, {"source": "cve@mitre.org", "tags": ["Broken Link"], "url": "http://duplicity.nongnu.org/CHANGELOG"}, {"source": "cve@mitre.org", "tags": ["Broken Link"], "url": "http://osvdb.org/42339"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "http://secunia.com/advisories/28917"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/27771"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=293081"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00356.html"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00445.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=442840"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link"], "url": "http://duplicity.nongnu.org/CHANGELOG"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link"], "url": "http://osvdb.org/42339"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "http://secunia.com/advisories/28917"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/27771"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=293081"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00356.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00445.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}]}