PT-2019-15240 · Eclipse · Eclipse Che

Michael Grube · Publicado 2019-12-19 · Atualizado 2019-12-27 · CVE-2019-17633

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Eclipse Che versions 6.16 through 7.3.0

Description The issue allows an attacker to trigger the start of an arbitrary Che workspace by visiting a malicious website, given that both authentication and TLS are disabled. This scenario is more likely in local installations, such as on personal laptops, where Che is not typically exposed to public networks. However, JavaScript running in the local browser can still send requests to the Che API, posing a risk even when the API is not externally exposed.

Recommendations For Eclipse Che versions 6.16 through 7.3.0, consider enabling authentication and TLS to prevent unauthorized access and mitigate the risk of arbitrary workspace startup. As a temporary workaround, restrict access to the Che API to minimize the risk of exploitation.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2019-17633

Produtos afetados

Eclipse Che

Referências · 4

• 🔥 https://github.com/mgrube/CVE-2019-17633 · Exploit
• 🔥 https://bugs.eclipse.org/bugs/show_bug.cgi?id=551596 · Exploit
• https://osv.dev/vulnerability/CVE-2019-17633 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-17633 · Nota de Segurança