title: XXE in eclipse.platform / Eclipse IDE
description: In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).
problem types: CWE-611 Improper Restriction of XML External Entity Reference
affected:
{
defaultStatus: unaffected
product: Eclipse IDE
vendor: Eclipse Foundation
versions:
lessThan: 4.29, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
product: Eclipse IDE
vendor: Eclipse Foundation
versions:
lessThan: 2023-09, status: affected, version: 0, versionType: custom
}
{
defaultStatus: unaffected
product: org.eclipse.core.runtime
vendor: Eclipse Foundation
versions:
lessThan: 3.29.0, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
product: org.eclipse.pde
vendor: Eclipse Foundation
versions:
lessThanOrEqual: 3.13.2400, status: affected, version: 0, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL