5

CVE-2023-4218: eclipse foundation eclipse ide

CVSS: 5.0v3.1MediumModified
AliasesSUSE-SU-2024:1304-1UBUNTU-CVE-2023-4218GHSA-j24h-xcpc-9jw8
Published 09-11-2023Last modified 03-09-2024
Open JSON

Vulnerability summary

CVE-2023-4218 is a medium (CVSS 5.0) vulnerability in eclipse foundation eclipse ide. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 31.4% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
5.0/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.39%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference

Timeline

  1. 09-11-2023
    PublishedVulnerability first disclosed.
  2. 03-09-2024
    Last modifiedVulnerability information updated.

Description

In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.39%

Chance of exploitation in the next 30 days

Percentile

31%

Versus all other CVEs

30-day change

0.00 pp

From 0.39% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.39%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (gitlab.eclipse.org)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Suse28 products
  • eclipse-bootstrap&distro=SUSE Linux Enterprise Module for Package Hub 15 SP5< 4.15-150200.4.16.5
  • eclipse-emf-bootstrap&distro=SUSE Linux Enterprise Module for Package Hub 15 SP5< 2.22.0-150200.4.9.3
  • eclipse-emf&distro=SUSE Linux Enterprise Module for Package Hub 15 SP5< 2.22.0-150200.4.9.3
  • eclipse&distro=SUSE Linux Enterprise Module for Package Hub 15 SP5< 4.15-150200.4.16.4
  • maven-surefire-plugins&distro=SUSE Enterprise Storage 7.1< 2.22.2-150200.3.9.9.1
Opensuse9 products
  • eclipse-bootstrap&distro=openSUSE Leap 15.5< 4.15-150200.4.16.5
  • eclipse-emf-bootstrap&distro=openSUSE Leap 15.5< 2.22.0-150200.4.9.3
  • eclipse-emf&distro=openSUSE Leap 15.5< 2.22.0-150200.4.9.3
  • eclipse&distro=openSUSE Leap 15.5< 4.15-150200.4.16.4
  • maven-surefire-plugins&distro=openSUSE Leap 15.5< 2.22.2-150200.3.9.9.1
Org.eclipse.platform7 products
  • org.eclipse.core.runtime< 3.29.0
  • org.eclipse.jface< 3.31.0
  • org.eclipse.platform< 4.29.0
  • org.eclipse.ui.forms< 3.13.0
  • org.eclipse.ui.ide< 3.21.100
Eclipse3 products
Eclipse foundation3 products
Org.eclipse.jdt1 product
  • org.eclipse.jdt.ui< 3.30.0
Ubuntu1 product
  • eclipseAll versions (No fix recorded)

7 vendors · 52 products

References

22 links
Show all 22 references