Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2005-2898: FileZilla saves passwords with weak encryption when secure mode off

CVE-2005-2898 · published 21 years ago

Summary

FileZilla versions 2.2.14b, 2.2.15 and possibly earlier keep the saved password in a file using a simple encryption that can be read by anyone with local access. If "Use secure mode" is turned off, a local user could retrieve those passwords. Enable "Use secure mode" or stop storing passwords in the program to protect the credentials.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
filezilla	filezilla	2.2.14b 2.2.15 `cpe:2.3:a:filezilla:filezilla:2.2.14b:::::::*`

Original advisory text

NOTE: this issue has been disputed by the vendor. FileZilla 2.2.14b and 2.2.15, and possibly earlier versions, when "Use secure mode" is disabled, uses a weak encryption scheme to store the user's...

NOTE: this issue has been disputed by the vendor. FileZilla 2.2.14b and 2.2.15, and possibly earlier versions, when "Use secure mode" is disabled, uses a weak encryption scheme to store the user's password in the configuration settings file, which allows local users to obtain sensitive information. NOTE: the vendor has disputed the issue, stating that "the problem is not a vulnerability at all, but in fact a fundamental issue of every single program that can store passwords transparently.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

4.6 Medium

Exploitation

<1% chance of attack within 30 days

Timeline

Published14 Sep 2005

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2005-2898 · NVD

Track software like this

Free during beta