CVE-1999-1562 in Ftp Client
Summary
by MITRE
gFTP FTP client 1.13, and other versions before 2.0.0, records a password in plaintext in (1) the log window, or (2) in a log file.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 04/19/2026
The vulnerability described in CVE-1999-1562 represents a critical security flaw in the gFTP FTP client software version 1.13 and earlier releases. This issue stems from the application's improper handling of authentication credentials during file transfer operations, specifically when logging connection details. The flaw manifests when the software stores passwords in plaintext format within either the graphical user interface's log window or in dedicated log files that persist on the local filesystem. This vulnerability directly violates fundamental security principles by exposing sensitive authentication information to potential unauthorized access through simple file system inspection or screen observation.
The technical implementation of this vulnerability involves the application's logging mechanism failing to properly sanitize or encrypt authentication credentials before storing them in persistent storage. When users establish FTP connections, the software typically requires username and password authentication to access remote servers. In the affected versions, the application's logging function indiscriminately captures and stores these credentials without any form of encryption or obfuscation, creating plaintext password exposure in both in-memory display components and file-based logging systems. This behavior constitutes a clear violation of secure coding practices and represents a significant weakness in the application's information protection mechanisms.
The operational impact of this vulnerability extends beyond simple credential exposure, as it creates multiple attack vectors for malicious actors. An attacker with access to the victim's system can retrieve stored passwords through simple file system enumeration or by examining the application's log window. This weakness particularly affects environments where multiple users share systems or where the application runs with elevated privileges. The vulnerability's persistence across system sessions means that compromised credentials remain accessible even after the application closes, creating long-term exposure windows for attackers. Additionally, the plaintext storage makes these credentials immediately usable for unauthorized access to FTP servers without requiring additional cracking or decryption efforts.
Security professionals should note that this vulnerability aligns with CWE-312 (CWE-312: Cleartext Storage of Sensitive Information) and represents a classic example of insecure data handling practices. The issue also correlates with ATT&CK technique T1555.003 (Credentials from Password Stores) as it provides attackers with direct access to stored credentials through log files. The vulnerability demonstrates the critical importance of proper input sanitization and secure credential handling in client applications, particularly those dealing with network authentication. Organizations should prioritize immediate remediation through software updates to version 2.0.0 or later, which presumably addressed this security flaw. Additional mitigations include implementing proper file system access controls, disabling unnecessary logging features, and conducting regular security audits of client applications to identify similar credential storage vulnerabilities. The broader implications highlight the necessity for comprehensive security testing during application development lifecycle phases to prevent such fundamental flaws from reaching production environments.