PT-2024-34794 · Eclipse · Eclipse Ditto

Manuel Sommer + 1 · Published 2024-05-23 · Updated 2025-01-31 · CVE-2024-5165

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Eclipse Ditto versions 3.0.0 through 3.5.5

Description The user input of several input fields of the Eclipse Ditto Explorer User Interface was not properly neutralized, making it vulnerable to both Reflected and Stored XSS (Cross Site Scripting). Several inputs were not persisted at the backend of Eclipse Ditto, but only in local browser storage, resulting in a Reflected XSS vulnerability. However, several other inputs were persisted at the backend of Eclipse Ditto, leading to a Stored XSS vulnerability. This means that authenticated and authorized users at Eclipse Ditto can persist Things in Ditto, which can cause scripts to be executed in the browser of other users when being displayed.

Recommendations For Eclipse Ditto versions 3.0.0 through 3.5.5, update to a version that properly neutralizes user input to prevent Reflected and Stored XSS vulnerabilities. As a temporary workaround, consider restricting access to the Eclipse Ditto Explorer User Interface to minimize the risk of exploitation. Avoid using the vulnerable input fields in the Eclipse Ditto Explorer User Interface until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-5165

GHSA-HJFC-6JXR-J2RX

Affected Products

Eclipse Ditto

References · 20

• https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/204 · Vendor Advisory
• https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/207 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-5165 · Vendor Advisory
• https://gitlab.eclipse.org/security/cve-assignement/-/issues/23 · Vendor Advisory
• https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/210 · Vendor Advisory
• https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/209 · Vendor Advisory
• https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/211 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hjfc-6jxr-j2rx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-5165 · Security Note
• https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/201 · Vendor Advisory
• https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/202 · Vendor Advisory
• https://github.com/eclipse-ditto/ditto/commit/20399a0ab9ef219c7833c24cf8140ddfb298788d · Note
• https://github.com/eclipse-ditto/ditto/commit/9d1bac36ca7be94516635ef71eedfea6df1e77f4 · Note
• https://github.com/eclipse-ditto/ditto/commit/cce2e961db08b5d591ef34920c61a0f7e7d810e4 · Note
• https://github.com/eclipse-ditto/ditto · Note