CVE-2019-17633

CVE-2019-17633 affects Eclipse Che versions 6.16–7.3.0 when authentication and TLS are disabled; a malicious webpage can trigger the start of an arbitrary Che workspace via local browser requests. The root cause is improper access control under unauthenticated, non-TLS conditions, enabling CSRF-l...

CVE-2021-41034

The CVE concerns Eclipse Che v6: builds of language stacks (Java 8 on Alpine/CentOS, Android, and PHP) pull binaries from an unsecured HTTP endpoint, enabling MITM substitution during the build process. The vulnerability affects the build-time retrieval of binaries, not runtime execution. Root ca...