CVE-2019-17633

For Eclipse Che versions 6.16 to 7.3.0, with both authentication and TLS disabled, visiting a malicious web site could trigger the start of an arbitrary Che workspace. Che with no authentication and no TLS is not usually deployed on a public network but is often used for local installations e.g. ...

CVE-2019-17633

CVE-2019-17633 affects Eclipse Che versions 6.16–7.3.0 when authentication and TLS are disabled; a malicious webpage can trigger the start of an arbitrary Che workspace via local browser requests. The root cause is improper access control under unauthenticated, non-TLS conditions, enabling CSRF-l...