CVE-2023-0100

2023-03-1515:15:09

CWE-20

[email protected]

web.nvd.nist.gov

eclipse birt

cve-2023-0100

report retrieval

http path

security vulnerability

patch

nvd

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

26.2%

JSON

In Eclipse BIRT, starting from version 2.6.2, the default configuration allowed to retrieve a report from the same host using an absolute HTTP path for the report parameter (e.g. __report=http://xyz.com/report.rptdesign). If the host indicated in the __report parameter matched the HTTP Host header value, the report would be retrieved. However, the Host header can be tampered with on some configurations where no virtual hosts are put in place (e.g. in the default configuration of Apache Tomcat) or when the default host points to the BIRT server. This vulnerability was patched on Eclipse BIRT 4.13.

Affected configurations

NVD

Node

eclipsebusiness_intelligence_and_reporting_toolsRange2.6.2–4.13.0

CPENameOperatorVersion
eclipse:business_intelligence_and_reporting_toolseclipse business intelligence and reporting toolslt4.13.0

CPE	Name	Operator	Version
eclipse:business_intelligence_and_reporting_tools	eclipse business intelligence and reporting tools	lt	4.13.0

CNA Affected

[
  {
    "vendor": "The Eclipse Foundation",
    "product": "Eclipse BIRT (Business Intelligence Reporting Tool)",
    "versions": [
      {
        "version": "2.6.2",
        "status": "affected",
        "lessThan": "unspecified",
        "versionType": "custom"
      },
      {
        "version": "unspecified",
        "lessThan": "4.13",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]