CVE-2023-4218
Medium
Description
In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).
SeverityMedium
CVSS5.0
Exploit probability—
ProductEclipse Ide
PublishedNov 9, 2023
First seenNov 9, 2023
Weakness typeCWE-611XML external entity (XXE)
How to fix
Update
- eclipse eclipse_ide4.29 or later
- eclipse org.eclipse.core.runtime3.29.0 or later
- eclipse pde3.13.2400 or later
- org.eclipse.platform:org.eclipse.core.runtime3.29.0 or later
- org.eclipse.platform:org.eclipse.platform4.29.0 or later
- org.eclipse.platform:org.eclipse.jface3.31.0 or later
- org.eclipse.platform:org.eclipse.ui.forms3.13.0 or later
- org.eclipse.platform:org.eclipse.ui.ide3.21.100 or later
- org.eclipse.platform:org.eclipse.ui.workbench3.130.0 or later
- org.eclipse.platform:org.eclipse.urischeme1.3.100 or later
- org.eclipse.jdt:org.eclipse.jdt.ui3.30.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| eclipse eclipse_ide | v < 4.29 | 4.29 |
| eclipse org.eclipse.core.runtime | v < 3.29.0 | 3.29.0 |
| eclipse pde | v < 3.13.2400 | 3.13.2400 |
| org.eclipse.platform:org.eclipse.core.runtimeMaven | v < 3.29.0 | 3.29.0 |
| org.eclipse.platform:org.eclipse.platformMaven | v < 4.29.0 | 4.29.0 |
| org.eclipse.platform:org.eclipse.jfaceMaven | v < 3.31.0 | 3.31.0 |
| org.eclipse.platform:org.eclipse.ui.formsMaven | v < 3.13.0 | 3.13.0 |
| org.eclipse.platform:org.eclipse.ui.ideMaven | v < 3.21.100 | 3.21.100 |
| org.eclipse.platform:org.eclipse.ui.workbenchMaven | v < 3.130.0 | 3.130.0 |
| org.eclipse.platform:org.eclipse.urischemeMaven | v < 1.3.100 | 1.3.100 |
| org.eclipse.jdt:org.eclipse.jdt.uiMaven | v < 3.30.0 | 3.30.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.