{"cve":"CVE-2005-2898","nvd":{"published":"2005-09-14T20:03:00.000","modified":"2026-06-16T22:15:52.847","status":"Modified","description":"NOTE: this issue has been disputed by the vendor.  FileZilla 2.2.14b and 2.2.15, and possibly earlier versions, when \"Use secure mode\" is disabled, uses a weak encryption scheme to store the user's password in the configuration settings file, which allows local users to obtain sensitive information.  NOTE: the vendor has disputed the issue, stating that \"the problem is not a vulnerability at all, but in fact a fundamental issue of every single program that can store passwords transparently.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["http://filezilla.sourceforge.net/forum/viewtopic.php?t=1328","http://marc.info/?l=bugtraq&m=112577523810442&w=2","http://marc.info/?l=bugtraq&m=112605448327521&w=2","http://www.securityfocus.com/bid/14730","https://exchange.xforce.ibmcloud.com/vulnerabilities/22135"],"products":["filezilla:filezilla"],"source":"nvd","synced_at":"2026-10-19T19:39:29.870204089+00:00"},"epss":{"cve":"CVE-2005-2898","score":0.00495,"percentile":0.42524,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}