94 matches found
CVE-2020-10689: Missing Authorization
A flaw was found in the Eclipse Che up to version 7.8.x, where it did not properly restrict access to workspace pods. An authenticated user can exploit this flaw to bypass JWT proxy and gain access to the workspace pods of another user. Successful exploitation requires knowledge of the service na...
PT-2020-12285
Name of the Vulnerable Software and Affected Versions Eclipse Che versions up to 7.8.x Description A flaw was found in Eclipse Che where it did not properly restrict access to workspace pods. An authenticated user can exploit this flaw to bypass JWT proxy and gain access to the workspace pods of...
CVE-2020-10689
A flaw was found in the Eclipse Che, where it did not properly restrict access to workspace pods. An authenticated user can exploit this flaw to bypass JWT proxy and gain access to the workspace pods of another user. Successful exploitation requires knowledge of the service name and namespace of...
Eclipse Che Cross Site Request Forgery (CVE-2019-17633)
A cross site request forgery vulnerability exists in Eclipse Che. Successful exploitation of this vulnerability could result in the execution of arbitrary code on the affected system...
Eclipse Che Cross-Site Request Forgery Vulnerability
Eclipse Che is the Eclipse Foundation's set of Java-based open source online integrated development environment IDE. A cross-site request forgery vulnerability exists in Eclipse Che versions 6.16 through 7.3.0. The vulnerability stems from a WEB application that does not adequately validate that ...
CVE-2019-17633
For Eclipse Che versions 6.16 to 7.3.0, with both authentication and TLS disabled, visiting a malicious web site could trigger the start of an arbitrary Che workspace. Che with no authentication and no TLS is not usually deployed on a public network but is often used for local installations e.g. ...
CVE-2019-17633
For Eclipse Che versions 6.16 to 7.3.0, with both authentication and TLS disabled, visiting a malicious web site could trigger the start of an arbitrary Che workspace. Che with no authentication and no TLS is not usually deployed on a public network but is often used for local installations e.g. ...
Authentication flaw
For Eclipse Che versions 6.16 to 7.3.0, with both authentication and TLS disabled, visiting a malicious web site could trigger the start of an arbitrary Che workspace. Che with no authentication and no TLS is not usually deployed on a public network but is often used for local installations e.g. ...
CVE-2019-17633
For Eclipse Che versions 6.16 to 7.3.0, with both authentication and TLS disabled, visiting a malicious web site could trigger the start of an arbitrary Che workspace. Che with no authentication and no TLS is not usually deployed on a public network but is often used for local installations e.g. ...
CVE-2019-17633
CVE-2019-17633 affects Eclipse Che versions 6.16–7.3.0 when authentication and TLS are disabled; a malicious webpage can trigger the start of an arbitrary Che workspace via local browser requests. The root cause is improper access control under unauthenticated, non-TLS conditions, enabling CSRF-l...
PT-2019-15240
Name of the Vulnerable Software and Affected Versions Eclipse Che versions 6.16 through 7.3.0 Description The issue allows an attacker to trigger the start of an arbitrary Che workspace by visiting a malicious website, given that both authentication and TLS are disabled. This scenario is more...
CVE-2019-17633: Cross-Site Request Forgery (CSRF)
For Eclipse Che versions 6.16 to 7.3.0, with both authentication and TLS disabled, visiting a malicious web site could trigger the start of an arbitrary Che workspace. Che with no authentication and no TLS is not usually deployed on a public network but is often used for local installations e.g. ...
