CVE-2005-2898: Weak Encryption
** DISPUTED ** NOTE: this issue has been disputed by the vendor. FileZilla 2.2.14b and 2.2.15, and possibly earlier versions, when "Use secure mode" is disabled, uses a weak encryption scheme to store the user's password in the configuration settings file, which allows local users to obtain sensitive information. NOTE: the vendor has disputed the issue, stating that "the problem is not a vulnerability at all, but in fact a fundamental issue of every single program that can store passwords transparently."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2005-2898?
CVE-2005-2898 is considered to be of medium severity due to its potential to expose sensitive user passwords.
How do I fix CVE-2005-2898?
To fix CVE-2005-2898, you should upgrade to a later version of FileZilla where the weak encryption vulnerability is addressed.
Which versions of FileZilla are affected by CVE-2005-2898?
CVE-2005-2898 affects FileZilla versions 2.2.14b and 2.2.15, and possibly earlier versions.
Can local users exploit CVE-2005-2898?
Yes, local users can exploit CVE-2005-2898 to obtain sensitive passwords stored in the configuration file when secure mode is disabled.
Is CVE-2005-2898 still a concern for current users of FileZilla?
CVE-2005-2898 is only a concern for users still using the vulnerable versions of FileZilla 2.2.14b and 2.2.15.