CVE-2023-4218: falha de média gravidade em Eclipse IDE
XXE in eclipse.platform / Eclipse IDE
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5epss 0.4%
In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Produtos afetados
Eclipse Foundation · Eclipse IDEEclipse Foundation · org.eclipse.core.runtimeEclipse Foundation · org.eclipse.pdeReferências
https://github.com/eclipse-cdt/cdt/commit/c7169b3186d2fef20f97467c3e2ad78e2943ed1bhttps://github.com/eclipse-emf/org.eclipse.emf/issues/10https://github.com/eclipse-jdt/eclipse.jdt.core/commit/38dd2a878f45cdb3d8d52090f1d6d1b532fd4c4dhttps://github.com/eclipse-jdt/eclipse.jdt.ui/commit/13675b1f8a74f47de4da89ed0ded6af7c21dfbechttps://github.com/eclipse-pde/eclipse.pde/pull/632/https://github.com/eclipse-pde/eclipse.pde/pull/667/https://github.com/eclipse-platform/eclipse.platform/pull/761https://github.com/eclipse-platform/eclipse.platform.releng.buildtools/pull/45https://github.com/eclipse-platform/eclipse.platform.swt/commit/bf71db5ddcb967c0863dad4745367b54f49e06bahttps://github.com/eclipse-platform/eclipse.platform.ui/commit/f243cf0a28785b89b7c50bf4e1cce48a917d89bdhttps://gitlab.eclipse.org/security/vulnerability-reports/-/issues/8