What is the CVSS score of CVE-2023-4218?

CVE-2023-4218 has a CVSS 3.1 base score of 5.0 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Is there a public PoC exploit available for CVE-2023-4218?

Yes, a public proof-of-concept exploit is available for CVE-2023-4218. Prioritise patching immediately. EPSS: 0.4%.

Is there a patch available for CVE-2023-4218?

Yes, a patch is available for CVE-2023-4218. Update the affected software to the latest version immediately.

Eclipse Ide CVE-2023-4218

MEDIUM

Improper Restriction of XML External Entity Reference (CWE-611)

2023-11-09 emo@eclipse.org

XXE Eclipse Ide Org Eclipse Core Runtime Pde

5.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.0 MEDIUM

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Nov 09, 2023 - 09:15 nvd

MEDIUM 5.0

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

18 maven packages depend on org.eclipse.jdt:org.eclipse.jdt.ui (16 direct, 2 indirect)
260 maven packages depend on org.eclipse.platform:org.eclipse.core.runtime (158 direct, 102 indirect)
117 maven packages depend on org.eclipse.platform:org.eclipse.jface (33 direct, 84 indirect)
1 maven packages depend on org.eclipse.platform:org.eclipse.platform (1 direct, 0 indirect)
49 maven packages depend on org.eclipse.platform:org.eclipse.ui.forms (21 direct, 28 indirect)

Ecosystem-wide dependent count for version 3.30.0 and other introduced versions.

DescriptionNVD

In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).

AnalysisAI

In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. Rated medium severity (CVSS 5.0), this vulnerability is low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified as XML External Entity (XXE) (CWE-611), which allows attackers to read arbitrary files or perform SSRF through XML processing. In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch). Affected products include: Eclipse Eclipse Ide, Eclipse Org.Eclipse.Core.Runtime, Eclipse Pde.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Disable external entity processing in XML parsers, use JSON instead of XML where possible.