CVE-2023-4218
09.11.2023, 09:15
In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| eclipse | eclipse_ide | 𝑥 < 4.29 |
| eclipse | org.eclipse.core.runtime | 𝑥 < 3.29.0 |
| eclipse | pde | 𝑥 < 3.13.2400 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| eclipse | ide | 𝑥 < 4.29 | CNA |
| eclipse | ide | 𝑥 < 3.29.0 | CNA |
| eclipse | ide | 𝑥 ≤ 3.13.2400 | CNA |
Ubuntu Releases
openSUSE / SLES Releases
openSUSE Product | |||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| maven-surefire |
| ||||||||||||||||||||||||||||||
| maven-surefire-plugin |
| ||||||||||||||||||||||||||||||
| maven-surefire-provider-junit |
| ||||||||||||||||||||||||||||||
| maven-surefire-provider-testng |
|
References