GitHub Advisory DatabaseGHSA-HJFC-6JXR-J2RXEclipse Ditto vulnerable to Cross-site Scripting
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
5.7 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
13.1%
In Eclipse Ditto starting in version 3.0.0 and prior to versions 3.4.5 and 3.5.6, the user input of several input fields of the Eclipse Ditto Explorer User Interface https://eclipse.dev/ditto/user-interface.html was not properly neutralized and thus vulnerable to both Reflected and Stored XSS (Cross Site Scripting).
Several inputs were not persisted at the backend of Eclipse Ditto, but only in local browser storage to save settings of “environments” of the UI and e.g. the last performed “search queries”, resulting in a “Reflected XSS” vulnerability.
However, several other inputs were persisted at the backend of Eclipse Ditto, leading to a “Stored XSS” vulnerability. Those mean that authenticated and authorized users at Eclipse Ditto can persist Things in Ditto which can - when being displayed by other users also being authorized to see those Things in the Eclipse Ditto UI - cause scripts to be executed in the browser of other users.
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| org.eclipse.ditto:ditto | lt | 3.5.6 | |
| org.eclipse.ditto:ditto | lt | 3.4.5 |
References
eclipse.dev/ditto/release_notes_345.html
eclipse.dev/ditto/release_notes_356.html
github.com/advisories/GHSA-hjfc-6jxr-j2rx
github.com/eclipse-ditto/ditto/commit/20399a0ab9ef219c7833c24cf8140ddfb298788d
github.com/eclipse-ditto/ditto/commit/8fe1b3b9e0e2c333856dc166c8c3c7d2027c856d
github.com/eclipse-ditto/ditto/commit/9d1bac36ca7be94516635ef71eedfea6df1e77f4
github.com/eclipse-ditto/ditto/commit/cce2e961db08b5d591ef34920c61a0f7e7d810e4
gitlab.eclipse.org/security/cve-assignement/-/issues/23
gitlab.eclipse.org/security/vulnerability-reports/-/issues/201
gitlab.eclipse.org/security/vulnerability-reports/-/issues/202
gitlab.eclipse.org/security/vulnerability-reports/-/issues/204
gitlab.eclipse.org/security/vulnerability-reports/-/issues/207
gitlab.eclipse.org/security/vulnerability-reports/-/issues/209
gitlab.eclipse.org/security/vulnerability-reports/-/issues/210
gitlab.eclipse.org/security/vulnerability-reports/-/issues/211
nvd.nist.gov/vuln/detail/CVE-2024-5165
Related
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
5.7 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
13.1%