PT-2020-9930 · Eclipse · Eclipse Web Tools Platform

David Dworken + 1 · Published 2020-07-15 · Updated 2023-01-27 · CVE-2019-17637

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Eclipse Web Tools Platform versions prior to 3.18 (2020-06)

Description The issue allows XML and DTD files referring to external entities to be exploited, sending the contents of local files to a remote server when edited or validated. This can occur even when external entity resolution is disabled in the user preferences.

Recommendations For Eclipse Web Tools Platform versions prior to 3.18 (2020-06), consider updating to a version newer than 3.18 (2020-06) to resolve the issue. As a temporary workaround, restrict the editing and validation of XML and DTD files that refer to external entities to minimize the risk of exploitation.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2019-17637

DLA-2404-1

Affected Products

Eclipse Web Tools Platform

References · 11

• 🔥 https://bugs.eclipse.org/bugs/show_bug.cgi?id=458571 · Exploit
• https://ubuntu.com/security/CVE-2019-17637 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-17637 · Security Note
• https://osv.dev/vulnerability/CVE-2019-17637 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-17637 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-17637 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2404-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-17637 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-17637 · Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2020/10/msg00016.html · Note
• https://t.me/cvenotify/5035 · Telegram Post