In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).
CVSS Details
- CVSS 3.1 Base Score: 5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Suse | — | Upgrade eclipse-jdtUpgrade eclipse-pdeUpgrade maven-surefire-javadocUpgrade maven-surefire-pluginUpgrade eclipse-emf-coreUpgrade maven-failsafe-pluginUpgrade eclipse-swtUpgrade eclipse-contributor-toolsUpgrade eclipse-equinox-osgi-bootstrapUpgrade eclipse-p2-discoveryUpgrade maven-surefire-provider-testngUpgrade eclipse-emf-core-bootstrapUpgrade tycho-bootstrapUpgrade eclipse-equinox-osgiUpgrade eclipse-p2-discovery-bootstrapUpgrade eclipse-pde-bootstrapUpgrade tychoUpgrade maven-surefire-report-plugin-bootstrapUpgrade maven-surefireUpgrade eclipse-swt-bootstrapUpgrade maven-surefire-report-pluginUpgrade maven-failsafe-plugin-bootstrapUpgrade eclipse-platformUpgrade maven-surefire-provider-junit5-javadocUpgrade maven-surefire-report-parserUpgrade eclipse-jdt-bootstrapUpgrade tycho-javadocUpgrade maven-surefire-provider-junitUpgrade maven-surefire-provider-junit5Upgrade eclipse-emf-runtimeUpgrade eclipse-platform-bootstrapUpgrade maven-surefire-plugins-javadocUpgrade eclipse-emf-sdkUpgrade eclipse-emf-xsdUpgrade maven-surefire-plugin-bootstrap | Apr 17, 2024 | Nov 9, 2023 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub