CVE-2021-28161

Exploit

EPSS 0.2%
Published 12.03.2021 22:15:15
Last modified 21.11.2024 05:59:12
Source emo@eclipse.org
Teams watchlist Login
Open Login

In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected.

Affected products Warnungen 0 Metrics 3 CWE 1 References 4

Data is provided by the National Vulnerability Database (NVD)

Eclipse ≫ Theia Version <= 1.8.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.2%	0.392

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	6.1	2.8	2.7	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvd@nist.gov	4.3	8.6	2.9	AV:N/AC:M/Au:N/C:N/I:P/A:N

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://github.com/eclipse-theia/theia/issues/8794

Third Party Advisory

Exploit

Issue Tracking

https://nvd.nist.gov/vuln/detail/CVE-2021-28161

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2021-28161

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2021-28161

EUVD