CVE-2021-28162
12.03.2021, 22:15
In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run.Enginsight
| Vendor | Product | Version |
|---|---|---|
| eclipse | theia | 𝑥 ≤ 0.16.0 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-830 - Inclusion of Web Functionality from an Untrusted SourceThe software includes web functionality (such as a web widget) from another domain, which causes it to operate within the domain of the software, potentially granting total access and control of the software to the untrusted source.
- CWE-829 - Inclusion of Functionality from Untrusted Control SphereThe software imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.