CVE-2020-27225: eclipse platform

CVSS: 7.8v3.1HighModified

AliasesMGASA-2021-0591RHEA-2021:1441UBUNTU-CVE-2020-27225+1 more

Published 09-03-2021Last modified 04-08-2024

Vulnerability summary

CVE-2020-27225 is a high (CVSS 7.8) vulnerability in eclipse platform. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 25.4% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

41/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.8/10

010

High · v3.1 (NVD)

EPSS score

0.34%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits1reference

Timeline

09-03-2021
PublishedVulnerability first disclosed.
04-08-2024
Last modifiedVulnerability information updated.

Description

In versions 4.18 and earlier of the Eclipse Platform, the Help Subsystem does not authenticate active help requests to the local help web server, allowing an unauthenticated local attacker to issue active help commands to the associated Eclipse Platform process or Eclipse Rich Client Platform process.

CVSS metrics

4 scores · 3 sources · 2 versions

v3.17.8v2.04.6

EPSS trend

Probability

0.34%

Chance of exploitation in the next 30 days

Percentile

25%

Versus all other CVEs

30-day change

0.00 pp

From 0.34% on 19-09-2026

19-09-202619-10-2026

EPSS score

0.34%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

referenceUnverified
Exploit Reference (bugs.eclipse.org)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Affected systems

Redhat61 products

rh-eclipse< 1:4.19-4.el7_9
rh-eclipse-apache-sshd< 1:2.6.0-1.2.el7_9
rh-eclipse-apache-sshd-javadoc< 1:2.6.0-1.2.el7_9
rh-eclipse-batik< 0:1.14-1.1.el7_9
rh-eclipse-batik-css< 0:1.14-1.1.el7_9

rh-eclipse-batik-demo< 0:1.14-1.1.el7_9
rh-eclipse-batik-javadoc< 0:1.14-1.1.el7_9
rh-eclipse-batik-rasterizer< 0:1.14-1.1.el7_9
rh-eclipse-batik-slideshow< 0:1.14-1.1.el7_9
rh-eclipse-batik-squiggle< 0:1.14-1.1.el7_9
rh-eclipse-batik-svgpp< 0:1.14-1.1.el7_9
rh-eclipse-batik-ttf2svg< 0:1.14-1.1.el7_9
rh-eclipse-batik-util< 0:1.14-1.1.el7_9
rh-eclipse-eclipse< 1:4.19-1.3.el7_9
rh-eclipse-eclipse-debuginfo< 1:4.19-1.3.el7_9
rh-eclipse-eclipse-egit< 0:5.11.0-1.1.el7_9
rh-eclipse-eclipse-emf< 1:2.25.0-1.1.el7_9
rh-eclipse-eclipse-emf-core< 1:2.25.0-1.1.el7_9
rh-eclipse-eclipse-emf-runtime< 1:2.25.0-1.1.el7_9
rh-eclipse-eclipse-emf-xsd< 1:2.25.0-1.1.el7_9
rh-eclipse-eclipse-equinox-osgi< 1:4.19-1.3.el7_9
rh-eclipse-eclipse-jdt< 1:4.19-1.3.el7_9
rh-eclipse-eclipse-jgit< 0:5.11.0-1.1.el7_9
rh-eclipse-eclipse-p2-discovery< 1:4.19-1.3.el7_9
rh-eclipse-eclipse-pde< 1:4.19-1.3.el7_9
rh-eclipse-eclipse-platform< 1:4.19-1.3.el7_9
rh-eclipse-eclipse-swt< 1:4.19-1.3.el7_9
rh-eclipse-jakarta-annotations< 0:1.3.5-7.1.el7_9
rh-eclipse-jakarta-annotations-javadoc< 0:1.3.5-7.1.el7_9
rh-eclipse-jetty< 0:9.4.38-1.1.el7_9
rh-eclipse-jetty-client< 0:9.4.38-1.1.el7_9
rh-eclipse-jetty-continuation< 0:9.4.38-1.1.el7_9
rh-eclipse-jetty-http< 0:9.4.38-1.1.el7_9
rh-eclipse-jetty-io< 0:9.4.38-1.1.el7_9
rh-eclipse-jetty-jaas< 0:9.4.38-1.1.el7_9
rh-eclipse-jetty-javadoc< 0:9.4.38-1.1.el7_9
rh-eclipse-jetty-jmx< 0:9.4.38-1.1.el7_9
rh-eclipse-jetty-security< 0:9.4.38-1.1.el7_9
rh-eclipse-jetty-server< 0:9.4.38-1.1.el7_9
rh-eclipse-jetty-servlet< 0:9.4.38-1.1.el7_9
rh-eclipse-jetty-util< 0:9.4.38-1.1.el7_9
rh-eclipse-jetty-util-ajax< 0:9.4.38-1.1.el7_9
rh-eclipse-jetty-webapp< 0:9.4.38-1.1.el7_9
rh-eclipse-jetty-xml< 0:9.4.38-1.1.el7_9
rh-eclipse-jgit< 0:5.11.0-1.1.el7_9
rh-eclipse-jgit-javadoc< 0:5.11.0-1.1.el7_9
rh-eclipse-objectweb-asm< 0:9.1-1.1.el7_9
rh-eclipse-objectweb-asm-javadoc< 0:9.1-1.1.el7_9
rh-eclipse-runtime< 1:4.19-4.el7_9
rh-eclipse-scldevel< 1:4.19-4.el7_9
rh-eclipse-takari-polyglot< 0:0.4.6-1.1.el7_9
rh-eclipse-takari-polyglot-atom< 0:0.4.6-1.1.el7_9
rh-eclipse-takari-polyglot-common< 0:0.4.6-1.1.el7_9
rh-eclipse-takari-polyglot-javadoc< 0:0.4.6-1.1.el7_9
rh-eclipse-takari-polyglot-maven-plugin< 0:0.4.6-1.1.el7_9
rh-eclipse-takari-polyglot-translate-plugin< 0:0.4.6-1.1.el7_9
rh-eclipse-takari-polyglot-xml< 0:0.4.6-1.1.el7_9
rh-eclipse-tycho< 0:2.2.0-4.1.el7_9
rh-eclipse-tycho-javadoc< 0:2.2.0-4.1.el7_9
rh-eclipse-xmlgraphics-commons< 0:2.6-1.1.el7_9
rh-eclipse-xmlgraphics-commons-javadoc< 0:2.6-1.1.el7_9

Show all 61

Opensuse2 products

eclipse-bootstrap&distro=openSUSE Leap 15.2< 4.9.0-lp152.3.3.1
eclipse&distro=openSUSE Leap 15.2< 4.9.0-lp152.3.3.1

Eclipse1 product

platform≤ 4.18

Mageia1 product

eclipse< 4.17-8.1.mga8

The eclipse foundation1 product

eclipse platform≥ unspecified, ≤ 4.18

Ubuntu1 product

eclipseAll versions (No fix recorded)

6 vendors · 67 products

References

15 links

bugs.eclipse.org/bugs/show_bug.cgi?id=569855X Refsource CONFIRMREPORTExploitIssue TrackingPatchVendor Advisory
advisories.mageia.org/MGASA-2021-0591.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=29048REPORT
lists.opensuse.org/archives/…WEBAdvisory
access.redhat.com/errata/RHEA-2021:1441Advisory
access.redhat.com/documentation/en-us/red_hat_developer_tools/1/html/using_eclipse_4.19/ARTICLE
issues.redhat.com/browse/RHECLIPSE-346ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2021/rhea-2021_1441.jsonAdvisory
access.redhat.com/security/cve/CVE-2020-27225REPORT
bugzilla.redhat.com/show_bug.cgi?id=1939630REPORT

Show all 15 references

www.cve.org/CVERecord?id=CVE-2020-27225AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2020-27225Advisory
ubuntu.com/security/CVE-2020-27225REPORT
bugzilla.suse.com/1183728REPORT
www.suse.com/security/cve/CVE-2020-27225WEB

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities