PT-2018-8450 · Eclipse · Eclipse Ide+1

Alon Boxiner + 3 · Published 2018-04-20 · Updated 2018-05-22 · CVE-2017-8315

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Eclipse XML parser for the Eclipse IDE versions 2017.2.5 and earlier

Description The Eclipse XML parser for the Eclipse IDE was found vulnerable to an XML External Entity attack. An attacker can exploit this issue by implementing malicious code on the Androidmanifest.xml file.

Recommendations For Eclipse XML parser for the Eclipse IDE versions 2017.2.5 and earlier, update to a version later than 2017.2.5 to resolve the issue.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2017-8315

Affected Products

Eclipse Ide

Eclipse Xml Parser

References · 9

• 🔥 https://research.checkpoint.com/parsedroid-targeting-android-development-research-community · Exploit
• https://security-tracker.debian.org/tracker/CVE-2017-8315 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-8315 · Security Note
• https://bugs.eclipse.org/bugs/show_bug.cgi?id=519169 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-8315 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-8315 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-8315 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-8315 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-8315 · Vendor Advisory