CVE-2019-17636CWE-345

CVE-2019-17636: fallo en The Eclipse Foundation Eclipse Theia

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Eclipse Theia+ Monitorear @theia/mini-browser

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

3Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackepss 0.6%
In Eclipse Theia versions 0.3.9 through 0.15.0, one of the default pre-packaged Theia extensions is "Mini-Browser", published as "@theia/mini-browser" on npmjs.com. This extension, for its own needs, exposes a HTTP endpoint that allows to read the content of files on the host's filesystem, given their path, without restrictions on the requester's origin. This design is vulnerable to being exploited remotely through a DNS rebinding attack or a drive-by download of a carefully crafted exploit.
Productos afectados
The Eclipse Foundation · Eclipse Theia
CVEs relacionadas — The Eclipse Foundation Eclipse Theia

En el mismo producto, de las más peligrosas a las menos.

CVE-2020-27224—CVE-2020-27224EPSS 2.6%CVE-2021-34436—CVE-2021-34436EPSS 2.2%CVE-2021-28162—CVE-2021-28162EPSS 0.8%CVE-2021-28161—CVE-2021-28161EPSS 0.7%CVE-2021-34435—CVE-2021-34435EPSS 0.6%