CVE-2019-17637

Katalog CVE

CVSS 7.1 · High EPSS 0,88%

Kerentanan Improper Restriction of XML External Entity Reference pada eclipse web tools platform, debian linux. Skor CVSS 3.1 7.1 (High) menurut NVD.

Deskripsi (NVD)

In all versions of Eclipse Web Tools Platform through release 3.18 (2020-06), XML and DTD files referring to external entities could be exploited to send the contents of local files to a remote server when edited or validated, even when external entity resolution is disabled in the user preferences.

Rincian

Terbit di NVD

15 Juli 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.1 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-611: Improper Restriction of XML External Entity Reference

EPSS (30 hari)

0,88% peluang dieksploitasi; lebih tinggi dari 58,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugs.eclipse.org/bugs/show_bug.cgi?id=458571 exploit · issue tracking · patch · advisory vendor
• https://lists.debian.org/debian-lts-announce/2020/10/msg00016.html mailing list · advisory pihak ketiga