CVE-2019-17637
N/A
N/A
Summary
In all versions of Eclipse Web Tools Platform through release 3.18 (2020-06), XML and DTD files referring to external entities could be exploited to send the contents of local files to a remote server when edited or validated, even when external entity resolution is disabled in the user preferences.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| The Eclipse Foundation | Eclipse Web Tools Platform | 1.0 to 3.18 | affected |
Weaknesses
- CWE-611: CWE-611: Improper Restriction of XML External Entity Reference (XXE)
ADP Enrichment
CVE Program Container
Additional References
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=458571
- https://lists.debian.org/debian-lts-announce/2020/10/msg00016.html
References
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=458571
- https://lists.debian.org/debian-lts-announce/2020/10/msg00016.html
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.