5

CVE-2023-4218

Exploit

XXE in eclipse.platform / Eclipse IDE

In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Eclipse ≫ Eclipse Ide Version < 4.29
Eclipse ≫ Org.Eclipse.Core.Runtime Version < 3.29.0
Eclipse ≫ Pde Version < 3.13.2400
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.39% 0.302
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5 1.3 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
emo@eclipse.org 5 1.3 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
CWE-611 Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

https://github.com/eclipse-cdt/cdt/commit/c7169b3186d2fef20f97467c3e2ad78e2943ed1b
Patch
https://github.com/eclipse-emf/org.eclipse.emf/issues/10
Third Party Advisory
Issue Tracking
https://github.com/eclipse-jdt/eclipse.jdt.core/commit/38dd2a878f45cdb3d8d52090f1d6d1b532fd4c4d
Patch
https://github.com/eclipse-jdt/eclipse.jdt.ui/commit/13675b1f8a74f47de4da89ed0ded6af7c21dfbec
Patch
https://github.com/eclipse-pde/eclipse.pde/pull/632/
Patch
https://github.com/eclipse-pde/eclipse.pde/pull/667/
Patch
https://github.com/eclipse-platform/eclipse.platform.releng.buildtools/pull/45
Patch
https://github.com/eclipse-platform/eclipse.platform.swt/commit/bf71db5ddcb967c0863dad4745367b54f49e06ba
Patch
https://github.com/eclipse-platform/eclipse.platform.ui/commit/f243cf0a28785b89b7c50bf4e1cce48a917d89bd
Patch
https://github.com/eclipse-platform/eclipse.platform/pull/761
Patch
https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/8
Vendor Advisory
Exploit
Issue Tracking