PT-2021-23059 · Eclipse · Eclipse Theia

Ndevtk · Published 2021-11-10 · Updated 2021-11-15 · CVE-2021-41038

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions @theia/plugin-ext component of Eclipse Theia versions prior to 1.18.0

Description The issue allows Webview contents to be hijacked via the postMessage() function.

Recommendations For versions prior to 1.18.0, update to version 1.18.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the postMessage() function until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-940

Related Identifiers

CVE-2021-41038

GHSA-W6V7-W58J-PG5R

Affected Products

Eclipse Theia

References · 8

• 🔥 https://bugs.eclipse.org/bugs/show_bug.cgi?id=575924 · Exploit
• https://github.com/eclipse-theia/theia/pull/10125 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-41038 · Security Note
• https://osv.dev/vulnerability/GHSA-w6v7-w58j-pg5r · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41038 · Vendor Advisory
• https://github.com/eclipse-theia/theia · Note
• https://t.me/cvenotify/23239 · Telegram Post
• https://t.me/cibsecurity/32188 · Telegram Post