cve.bz

CVE-2023-4218

5.0 mediumEPSS 0.4%

Medium (5.0) in eclipse. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in org.eclipse.platform:org.eclipse.core.runtime 3.29.0.

In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).

Severity

CVSS 3.1

5.0 medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
EPSS
0.4% chance of exploitation in the next 30 days; higher than 33% of CVEs (scores of 2026-10-31)
CWE
CWE-611
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-j24h-xcpc-9jw8Mavenorg.eclipse.platform:org.eclipse.core.runtime<3.29.03.29.0
GHSA-j24h-xcpc-9jw8Mavenorg.eclipse.platform:org.eclipse.platform<4.29.04.29.0
GHSA-j24h-xcpc-9jw8Mavenorg.eclipse.platform:org.eclipse.jface<3.31.03.31.0
GHSA-j24h-xcpc-9jw8Mavenorg.eclipse.platform:org.eclipse.ui.forms<3.13.03.13.0
GHSA-j24h-xcpc-9jw8Mavenorg.eclipse.platform:org.eclipse.ui.ide<3.21.1003.21.100
GHSA-j24h-xcpc-9jw8Mavenorg.eclipse.platform:org.eclipse.ui.workbench<3.130.03.130.0
GHSA-j24h-xcpc-9jw8Mavenorg.eclipse.platform:org.eclipse.urischeme<1.3.1001.3.100
GHSA-j24h-xcpc-9jw8Mavenorg.eclipse.jdt:org.eclipse.jdt.ui<3.30.03.30.0

References

Check your stackJSON