CVE-2023-4218 XXE in eclipse.platform / Eclipse IDE

2023-11-0908:26:51

CWE-611

eclipse

www.cve.org

cve-2023-4218

eclipse ide

xxe vulnerability

xml parsing

security threat

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

16.0%

JSON

In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Eclipse IDE",
    "vendor": "Eclipse Foundation",
    "versions": [
      {
        "lessThan": "4.29",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Eclipse IDE",
    "vendor": "Eclipse Foundation",
    "versions": [
      {
        "lessThan": "2023-09",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "org.eclipse.core.runtime",
    "vendor": "Eclipse Foundation",
    "versions": [
      {
        "lessThan": "3.29.0",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "org.eclipse.pde",
    "vendor": "Eclipse Foundation",
    "versions": [
      {
        "lessThanOrEqual": "3.13.2400",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]