Skip to content
Fencer Vulns
high 7.8

CVE-2020-27225 json

In versions 4.18 and earlier of the Eclipse Platform, the Help Subsystem does not authenticate active help requests to the local help web s…

published 2021-03-09 5 y ago modified 2026-06-17 4 mo ago also EUVD-2020-19738

cvss
7.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 27%
public exploits
0
none known

Summary

In versions 4.18 and earlier of the Eclipse Platform, the Help Subsystem does not authenticate active help requests to the local help web server, allowing an unauthenticated local attacker to issue active help commands to the associated Eclipse Platform process or Eclipse Rich Client Platform process.

Patch / fix

  • rh-eclipse devtools 2021 1:4.19-4.el7_9
  • rh-eclipse-jgit devtools 2021 5.11.0-1.1.el7_9
  • rh-eclipse-batik devtools 2021 1.14-1.1.el7_9
  • rh-eclipse-jetty devtools 2021 9.4.38-1.1.el7_9
  • rh-eclipse-tycho devtools 2021 2.2.0-4.1.el7_9
  • rh-eclipse-eclipse devtools 2021 1:4.19-1.3.el7_9
  • rh-eclipse-runtime devtools 2021 1:4.19-4.el7_9
  • rh-eclipse-jetty-io devtools 2021 9.4.38-1.1.el7_9

red hat advisories RHEA-2021:1441

  • eclipse openSUSE Leap 15.2 4.9.0-lp152.3.3.1
  • eclipse-bootstrap openSUSE Leap 15.2 4.9.0-lp152.3.3.1

opensuse advisories openSUSE-SU-2021:0485-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-27225 updated cvss 7.8

eclipse: Help Subsystem does not authenticate active help requests

  • Red Hat Enterprise Linux 6 eclipse, eclipse-jdt, eclipse-pde, eclipse-rcp, eclipse-swt, eclipse-platform
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 eclipse-jdt, eclipse-pde, eclipse-swt, eclipse-platform, eclipse-equinox-osgi, eclipse-p2-discovery
    affected: no fix planned “Will not fix”
  • Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) rh-eclipse 4.19-4.el7_9, rh-eclipse-batik 1.14-1.1.el7_9, rh-eclipse-runtime 4.19-4.el7_9, rh-eclipse-jgit 5.11.0-1.1.el7_9, rh-eclipse-scldevel 4.19-4.el7_9, rh-eclipse-tycho 2.2.0-4.1.el7_9, +54 more Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) rh-eclipse 4.19-4.el7_9, rh-eclipse-batik 1.14-1.1.el7_9, rh-eclipse-runtime 4.19-4.el7_9, rh-eclipse-jgit 5.11.0-1.1.el7_9, rh-eclipse-scldevel 4.19-4.el7_9, rh-eclipse-tycho 2.2.0-4.1.el7_9, +54 more
    fixed: vendor fix RHEA-2021:1441

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.34% chance of exploitation in the next 30 days, higher than 27% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • bugs.eclipse.org https://bugs.eclipse.org/bugs/show_bug.cgi?id=569855 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P

Affected products

  • The Eclipse Foundation Eclipse Platform

Classification

Weakness
  • CWE-306 Missing Authentication for Critical Functionality

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.