In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).
CVSS Details
- CVSS 3.1 Base Score: 5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Suse | — | Upgrade maven-failsafe-plugin-bootstrapUpgrade eclipse-jdt-bootstrapUpgrade eclipse-emf-sdkUpgrade maven-surefire-provider-junit5Upgrade eclipse-emf-runtimeUpgrade maven-surefireUpgrade eclipse-platform-bootstrapUpgrade eclipse-emf-xsdUpgrade maven-surefire-report-parserUpgrade eclipse-platformUpgrade maven-surefire-plugins-javadocUpgrade tycho-javadocUpgrade maven-surefire-plugin-bootstrapUpgrade maven-surefire-provider-junitUpgrade maven-surefire-provider-junit5-javadocUpgrade eclipse-swt-bootstrapUpgrade maven-surefire-report-pluginUpgrade eclipse-equinox-osgi-bootstrapUpgrade eclipse-contributor-toolsUpgrade tychoUpgrade eclipse-p2-discovery-bootstrapUpgrade maven-surefire-report-plugin-bootstrapUpgrade eclipse-emf-core-bootstrapUpgrade maven-surefire-javadocUpgrade eclipse-pdeUpgrade maven-failsafe-pluginUpgrade eclipse-emf-coreUpgrade maven-surefire-pluginUpgrade maven-surefire-provider-testngUpgrade tycho-bootstrapUpgrade eclipse-equinox-osgiUpgrade eclipse-swtUpgrade eclipse-pde-bootstrapUpgrade eclipse-p2-discoveryUpgrade eclipse-jdt | Apr 17, 2024 | Nov 9, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub