Detections
Analytics

Echo: vim: security update to 2:9.2.0218-1+e1

high Tenable Self-Hosted Container Security Plugin ID 459967

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - autoload/netrw.vim (aka the Netrw Plugin) 109, 131, and other versions before 133k for Vim 7.1.266, other
 7.1 versions, and 7.2 stores credentials for an FTP session, and sends those credentials when attempting
 to establish subsequent FTP sessions to servers on different hosts, which allows remote FTP servers to
 obtain sensitive information in opportunistic circumstances by logging usernames and passwords. NOTE: the
 upstream vendor disputes a vector involving different ports on the same host, stating "I'm assuming that
 they're using the same id and password on that unchanged hostname, deliberately." (CVE-2008-4677)

Solution

Update the vim library and its related packages to version 2:9.2.0218-1+e1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2008-4677

Plugin Details

Severity: High

ID: 459967

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2008-4677

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/15/2025

Vulnerability Publication Date: 8/12/2008

Reference Information

CVE: CVE-2008-4677