CVE-2023-4218

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-4218
In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).

5.0 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.3 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/eclipse-cdt/cdt/commit/c7169b3186d2fef20f97467c3e2ad78e2943ed1b Patch
https://github.com/eclipse-emf/org.eclipse.emf/issues/10 Issue Tracking Third Party Advisory
https://github.com/eclipse-jdt/eclipse.jdt.core/commit/38dd2a878f45cdb3d8d52090f1d6d1b532fd4c4d Patch
https://github.com/eclipse-jdt/eclipse.jdt.ui/commit/13675b1f8a74f47de4da89ed0ded6af7c21dfbec Patch
https://github.com/eclipse-pde/eclipse.pde/pull/632/ Patch
https://github.com/eclipse-pde/eclipse.pde/pull/667/ Patch
https://github.com/eclipse-platform/eclipse.platform.releng.buildtools/pull/45 Patch
https://github.com/eclipse-platform/eclipse.platform.swt/commit/bf71db5ddcb967c0863dad4745367b54f49e06ba Patch
https://github.com/eclipse-platform/eclipse.platform.ui/commit/f243cf0a28785b89b7c50bf4e1cce48a917d89bd Patch
https://github.com/eclipse-platform/eclipse.platform/pull/761 Patch
https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/8 Exploit Issue Tracking Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:eclipse:eclipse_ide:*:*:*:*:*:*:*:*
cpe:2.3:a:eclipse:org.eclipse.core.runtime:*:*:*:*:*:*:*:*
cpe:2.3:a:eclipse:pde:*:*:*:*:*:*:*:*
History

24 Nov 2023, 18:25

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.0
First Time Eclipse eclipse Ide
Eclipse
Eclipse org.eclipse.core.runtime
Eclipse pde
CPE cpe:2.3:a:eclipse:pde:*:*:*:*:*:*:*:*
cpe:2.3:a:eclipse:org.eclipse.core.runtime:*:*:*:*:*:*:*:*
cpe:2.3:a:eclipse:eclipse_ide:*:*:*:*:*:*:*:*
CWE CWE-611
References () https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/8 - () https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/8 - Exploit, Issue Tracking, Vendor Advisory
References () https://github.com/eclipse-platform/eclipse.platform.swt/commit/bf71db5ddcb967c0863dad4745367b54f49e06ba - () https://github.com/eclipse-platform/eclipse.platform.swt/commit/bf71db5ddcb967c0863dad4745367b54f49e06ba - Patch
References () https://github.com/eclipse-pde/eclipse.pde/pull/667/ - () https://github.com/eclipse-pde/eclipse.pde/pull/667/ - Patch
References () https://github.com/eclipse-platform/eclipse.platform/pull/761 - () https://github.com/eclipse-platform/eclipse.platform/pull/761 - Patch
References () https://github.com/eclipse-jdt/eclipse.jdt.ui/commit/13675b1f8a74f47de4da89ed0ded6af7c21dfbec - () https://github.com/eclipse-jdt/eclipse.jdt.ui/commit/13675b1f8a74f47de4da89ed0ded6af7c21dfbec - Patch
References () https://github.com/eclipse-jdt/eclipse.jdt.core/commit/38dd2a878f45cdb3d8d52090f1d6d1b532fd4c4d - () https://github.com/eclipse-jdt/eclipse.jdt.core/commit/38dd2a878f45cdb3d8d52090f1d6d1b532fd4c4d - Patch
References () https://github.com/eclipse-pde/eclipse.pde/pull/632/ - () https://github.com/eclipse-pde/eclipse.pde/pull/632/ - Patch
References () https://github.com/eclipse-emf/org.eclipse.emf/issues/10 - () https://github.com/eclipse-emf/org.eclipse.emf/issues/10 - Issue Tracking, Third Party Advisory
References () https://github.com/eclipse-cdt/cdt/commit/c7169b3186d2fef20f97467c3e2ad78e2943ed1b - () https://github.com/eclipse-cdt/cdt/commit/c7169b3186d2fef20f97467c3e2ad78e2943ed1b - Patch
References () https://github.com/eclipse-platform/eclipse.platform.releng.buildtools/pull/45 - () https://github.com/eclipse-platform/eclipse.platform.releng.buildtools/pull/45 - Patch
References () https://github.com/eclipse-platform/eclipse.platform.ui/commit/f243cf0a28785b89b7c50bf4e1cce48a917d89bd - () https://github.com/eclipse-platform/eclipse.platform.ui/commit/f243cf0a28785b89b7c50bf4e1cce48a917d89bd - Patch

09 Nov 2023, 13:46

Type Values Removed Values Added
New CVE
Information

Published : 2023-11-09 09:15

Updated : 2023-12-10 15:26

NVD link : CVE-2023-4218

Mitre link : CVE-2023-4218

CVE.ORG link : CVE-2023-4218

JSON object : View

Products Affected

eclipse

  • org.eclipse.core.runtime
  • eclipse_ide
  • pde
CWE
CWE-611

Improper Restriction of XML External Entity Reference