PT-2021-11321 · Eclipse+1 · Eclipse Platform+1

Andrew Johnson · Published 2021-03-09 · Updated 2022-07-22 · CVE-2020-27225

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Eclipse Platform versions 4.18 and earlier

Description: The Help Subsystem in the Eclipse Platform does not authenticate active help requests to the local help web server. This allows an unauthenticated local attacker to issue active help commands to the associated Eclipse Platform process or Eclipse Rich Client Platform process.

Recommendations: For versions 4.18 and earlier, consider disabling the Help Subsystem until a patch is available to prevent unauthorized access to the local help web server. Restrict access to the local help web server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2020-27225

MGASA-2021-0591

OESA-2022-1759

OPENSUSE-SU-2021:0485-1

OPENSUSE-SU-2021_0485-1

OPENSUSE-SU-2024:10732-1

Affected Products

Eclipse Platform

Suse

References · 16

• 🔥 https://bugs.eclipse.org/bugs/show_bug.cgi?id=569855 · Exploit
• https://osv.dev/vulnerability/CVE-2020-27225 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27225 · Security Note
• https://osv.dev/vulnerability/OESA-2022-1759 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0591 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0591.html · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-27225 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-27225 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:0485-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-27225 · Security Note
• https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1759 · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/GFMJOYKYZTYC75UCIIQQRAD674LFJI3L · Note
• https://bugzilla.suse.com/1183728 · Note
• https://suse.com/security/cve/CVE-2020-27225 · Note
• https://bugs.mageia.org/show_bug.cgi?id=29048 · Note