CVE-2021-41033
High
Description
In all released versions of Eclipse Equinox, at least until version 4.21 (September 2021), installation can be vulnerable to man-in-the-middle attack if using p2 repos that are HTTP; that can then be exploited to serve incorrect p2 metadata and entirely alter the local installation, particularly by installing plug-ins that may then run malicious code.
SeverityHigh
CVSS8.1
Exploit probability—
ProductEclipse Equinox
PublishedSep 13, 2021
First seenSep 13, 2021
Weakness typeCWE-300CWE-300
How to fix
Update
- eclipse equinox4.21 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| eclipse equinox | v < 4.21, 4.21 | 4.21 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.