CVE-2019-17637

HIGH

Eclipse Web Tools Platform < 3.18 - XML External Entity Injection via DTD File Processing

Title source: llm

Description

In all versions of Eclipse Web Tools Platform through release 3.18 (2020-06), XML and DTD files referring to external entities could be exploited to send the contents of local files to a remote server when edited or validated, even when external entity resolution is disabled in the user preferences.

References (2)

Core 2

Core References

Exploit, Issue Tracking, Patch, Vendor Advisory x_refsource_confirm

https://bugs.eclipse.org/bugs/show_bug.cgi?id=458571

Mailing List, Third Party Advisory mailing-list x_refsource_mlist

https://lists.debian.org/debian-lts-announce/2020/10/msg00016.html

Scores

CVSS v3 7.1

EPSS 0.0016

EPSS Percentile 37.1%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Details

CWE

CWE-611

Status published

Products (2)

debian/debian_linux 9.0

eclipse/web_tools_platform 1.0 - 3.18

Published Jul 15, 2020

Tracked Since Feb 18, 2026