CVE-2023-4218 json
XXE in eclipse.platform / Eclipse IDE
published 2023-11-09 3 y ago modified 2026-06-17 4 mo ago also GHSA-j24h-xcpc-9jw8 , EUVD-2023-2980
- cvss
- 5.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 33%
- public exploits
- 0
- none known
Summary
In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).
Patch / fix
- maven org.eclipse.platform:org.eclipse.core.runtime 3.29.0
- maven org.eclipse.platform:org.eclipse.platform 4.29.0
- maven org.eclipse.platform:org.eclipse.jface 3.31.0
- maven org.eclipse.platform:org.eclipse.ui.forms 3.13.0
- maven org.eclipse.platform:org.eclipse.ui.ide 3.21.100
- maven org.eclipse.platform:org.eclipse.ui.workbench 3.130.0
- maven org.eclipse.platform:org.eclipse.urischeme 1.3.100
- maven org.eclipse.jdt:org.eclipse.jdt.ui 3.30.0
- Eclipse Foundation Eclipse IDE 4.29, 2023-09
- Eclipse Foundation org.eclipse.core.runtime 3.29.0
- tycho openSUSE Leap 15.5 1.6.0-150200.4.9.5
- eclipse SLE Module for Package Hub 15 SP5, openSUSE Leap 15.5 4.15-150200.4.16.4
- eclipse-emf SLE Module for Package Hub 15 SP5, openSUSE Leap 15.5 2.22.0-150200.4.9.3
- maven-surefire SLES for SAP 15 SP4, SLES for SAP 15 SP3, SLES for SAP 15 SP2 +10 more 2.22.2-150200.3.9.9.1
- tycho-bootstrap openSUSE Leap 15.5 1.6.0-150200.4.9.2
- eclipse-bootstrap SLE Module for Package Hub 15 SP5, openSUSE Leap 15.5 4.15-150200.4.16.5
- eclipse-emf-bootstrap SLE Module for Package Hub 15 SP5, openSUSE Leap 15.5 2.22.0-150200.4.9.3
- maven-surefire-plugins SLES for SAP 15 SP4, SLES for SAP 15 SP3, SLES for SAP 15 SP2 +10 more 2.22.2-150200.3.9.9.1
suse advisories SUSE-SU-2024:1304-1
- github.com/eclipse-platform/eclipse.platform.ui@f243cf0 commit
- github.com/eclipse-jdt/eclipse.jdt.ui@13675b1 commit
- github.com/eclipse-jdt/eclipse.jdt.core@38dd2a8 commit
- github.com/eclipse-platform/eclipse.platform.swt@bf71db5 commit
- github.com/eclipse-cdt/cdt@c7169b3 commit
- github.com/eclipse-platform/eclipse.platform@5dc372a commit
- github.com/eclipse-pde/eclipse.pde#632 pull request
- github.com/eclipse-pde/eclipse.pde#667 pull request
- github.com/eclipse-platform/eclipse.platform#761 pull request
- github.com/eclipse-platform/eclipse.platform.releng.buildtools#45 pull request
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
0.39% chance of exploitation in the next 30 days, higher than 33% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- gitlab.eclipse.org https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/8 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.0 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N |
| NVD | 3.1 | 5.0 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 5.0 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.eclipse.platform:org.eclipse.core.runtime | <3.29.0 |
3.29.0 |
| maven | org.eclipse.platform:org.eclipse.platform | <4.29.0 |
4.29.0 |
| maven | org.eclipse.platform:org.eclipse.jface | <3.31.0 |
3.31.0 |
| maven | org.eclipse.platform:org.eclipse.ui.forms | <3.13.0 |
3.13.0 |
| maven | org.eclipse.platform:org.eclipse.ui.ide | <3.21.100 |
3.21.100 |
| maven | org.eclipse.platform:org.eclipse.ui.workbench | <3.130.0 |
3.130.0 |
| maven | org.eclipse.platform:org.eclipse.urischeme | <1.3.100 |
1.3.100 |
| maven | org.eclipse.jdt:org.eclipse.jdt.ui | <3.30.0 |
3.30.0 |
Affected products
- Eclipse Foundation Eclipse IDE
- Eclipse Foundation org.eclipse.core.runtime
- Eclipse Foundation org.eclipse.pde
Classification
- Weakness
-
- CWE-611 Improper Restriction of XML External Entity Reference
References
-
github.com
/eclipse-pde/eclipse.pde/pull/632/
patch
-
github.com
/eclipse-pde/eclipse.pde/pull/667/
patch
-
github.com
/eclipse-platform/eclipse.platform/pull/761
web, patch
-
github.com
/eclipse-platform/eclipse.platform.releng.buildtools/pull/45
web, patch
-
github.com
/eclipse-platform/eclipse.platform.ui/commit/f243cf0a28785b89b7c50bf4e1cce48a917d89bd
web, patch
-
github.com
/eclipse-jdt/eclipse.jdt.ui/commit/13675b1f8a74f47de4da89ed0ded6af7c21dfbec
web, patch
-
github.com
/eclipse-jdt/eclipse.jdt.core/commit/38dd2a878f45cdb3d8d52090f1d6d1b532fd4c4d
web, patch
-
github.com
/eclipse-platform/eclipse.platform.swt/commit/bf71db5ddcb967c0863dad4745367b54f49e06ba
web, patch
-
github.com
/eclipse-cdt/cdt/commit/c7169b3186d2fef20f97467c3e2ad78e2943ed1b
web, patch
-
github.com
/eclipse-pde/eclipse.pde/pull/632
web
-
github.com
/eclipse-pde/eclipse.pde/pull/667
web
-
github.com
/eclipse-platform/eclipse.platform/commit/5dc372a0c5002b7f22e5d49eaa1cbf0916455daf
web
-
gitlab.eclipse.org
/security/vulnerability-reports/-/issues/8
web, exploit, issue-tracking, vendor-advisory
-
github.com
/eclipse-emf/org.eclipse.emf/issues/10
web, issue-tracking, third-party-advisory
-
github.com
/eclipse-platform/eclipse.platform/security/advisories/GHSA-j24h-xcpc-9jw8
web
-
nvd.nist.gov
/vuln/detail/CVE-2023-4218
advisory
-
github.com
/eclipse-platform/eclipse.platform
package
Sources
- CVE List CVE-2023-4218
- GitHub Advisory GHSA-j24h-xcpc-9jw8
- NVD CVE-2023-4218
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.