CVE-2023-4218CWE-611

XXE in eclipse.platform / Eclipse IDE

Medium · published November 9, 2023

CVSS v3.1
5.0
EPSS
0%
Percentile
31.9
In the wild
Unconfirmed
What it is

In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00390 · 31.9th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2023-11-09T08:26Z
EPSS history
Timeline
  • 09 NOV 08:26Z
    XXE in eclipse.platform / Eclipse IDE
    cvelistv5