5.0
Medium
CVE-2023-4218 In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE…
Description
In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Eclipse IDE 2023 | earliest → < 2023-09 | 2023-09 |
| org.eclipse.core.runtime 3.29 | earliest → < 3.29.0 | 3.29.0 |
| org.eclipse.pde 3.13 | earliest → 3.13.2400 | No fix stated |