In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).
CVSS Details
- CVSS 3.1 Base Score: 5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Suse | — | suse-upgrade-eclipse-contributor-toolssuse-upgrade-eclipse-emf-coresuse-upgrade-eclipse-emf-core-bootstrapsuse-upgrade-eclipse-emf-runtimesuse-upgrade-eclipse-emf-sdksuse-upgrade-eclipse-emf-xsdsuse-upgrade-eclipse-equinox-osgisuse-upgrade-eclipse-equinox-osgi-bootstrapsuse-upgrade-eclipse-jdtsuse-upgrade-eclipse-jdt-bootstrapsuse-upgrade-eclipse-p2-discoverysuse-upgrade-eclipse-p2-discovery-bootstrapsuse-upgrade-eclipse-pdesuse-upgrade-eclipse-pde-bootstrapsuse-upgrade-eclipse-platformsuse-upgrade-eclipse-platform-bootstrapsuse-upgrade-eclipse-swtsuse-upgrade-eclipse-swt-bootstrapsuse-upgrade-maven-failsafe-pluginsuse-upgrade-maven-failsafe-plugin-bootstrapsuse-upgrade-maven-surefiresuse-upgrade-maven-surefire-javadocsuse-upgrade-maven-surefire-pluginsuse-upgrade-maven-surefire-plugin-bootstrapsuse-upgrade-maven-surefire-plugins-javadocsuse-upgrade-maven-surefire-provider-junitsuse-upgrade-maven-surefire-provider-junit5suse-upgrade-maven-surefire-provider-junit5-javadocsuse-upgrade-maven-surefire-provider-testngsuse-upgrade-maven-surefire-report-parsersuse-upgrade-maven-surefire-report-pluginsuse-upgrade-maven-surefire-report-plugin-bootstrapsuse-upgrade-tychosuse-upgrade-tycho-bootstrapsuse-upgrade-tycho-javadoc | Apr 17, 2024 | Nov 9, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub