CVE-2023-6194: eclipse foundation eclipse memory analyzer (tools.mat)
Vulnerability summary
CVE-2023-6194 is a high (CVSS 7.1) vulnerability in eclipse foundation eclipse memory analyzer (tools.mat). EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 23.1% of scored vulnerabilities. 3 public exploits are recorded.
Timeline
- 11-12-2023PublishedVulnerability first disclosed.
- 02-08-2024Last modifiedVulnerability information updated.
Description
In Eclipse Memory Analyzer versions 0.7 to 1.14.0, report definition XML files are not filtered to prohibit document type definition (DTD) references to external entities. This means that if a user chooses to use a malicious report definition XML file containing an external entity reference to generate a report then Eclipse Memory Analyzer may access external files or URLs defined via a DTD in the report definition.
CVSS metrics
3 scores · 3 sources · 1 version- CVE.orgCNA2.8LowCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
EPSS trend
Probability
0.32%
Chance of exploitation in the next 30 days
Percentile
23%
Versus all other CVEs
30-day change
0.00 pp
From 0.32% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 foundExploit Reference (gitlab.eclipse.org)
Maturity: unknown
Exploit Reference (bugs.eclipse.org)
Maturity: unknown
Exploit Reference (gitlab.eclipse.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Eclipse1 product
- memory_analyzer≥ 0.7, ≤ 1.14.0
Eclipse foundation1 product
- eclipse memory analyzer (tools.mat)≥ 0.7, ≤ 1.14.0
Ubuntu1 product
- eclipseAll versions (No fix recorded)
3 vendors · 3 products
References
5 links- gitlab.eclipse.org/security/vulnerability-reports/-/issues/169REPORTExploitIssue TrackingVendor Advisory