CVE-2023-0100
Description
In Eclipse BIRT, starting from version 2.6.2, the default configuration allowed to retrieve a report from the same host using an absolute HTTP path for the report parameter (e.g. __report=http://xyz.com/report.rptdesign). If the host indicated in the __report parameter matched the HTTP Host header value, the report would be retrieved. However, the Host header can be tampered with on some configurations where no virtual hosts are put in place (e.g. in the default configuration of Apache Tomcat) or when the default host points to the BIRT server. This vulnerability was patched on Eclipse BIRT 4.13.
How to fix
- eclipse business_intelligence_and_reporting_tools4.13.0 or later
- org.eclipse.birt:org.eclipse.birt.report.viewer4.13 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| eclipse business_intelligence_and_reporting_tools | 2.6.2 ≤ v < 4.13.0 | 4.13.0 |
| org.eclipse.birt:org.eclipse.birt.report.viewerMaven | 2.6.2 ≤ v < 4.13 | 4.13 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.