CVE-2020-27225
In versions 4.18 and earlier of the Eclipse Platform, the Help Subsystem does not authenticate...
In versions 4.18 and earlier of the Eclipse Platform, the Help Subsystem does not authenticate active help requests to the local help web server, allowing an unauthenticated local attacker to issue active help commands to the associated Eclipse Platform process or Eclipse Rich Client Platform process.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In versions 4.18 and earlier of the Eclipse Platform, the Help Subsystem does not authenticate active help requests to the local help web server, allowing an unauthenticated local attacker to issue active help commands to the associated Eclipse Platform process or Eclipse Rich Client Platform process.
- Record
CVE-2020-27225- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-306
- Updated
- 2026-11-02
CVE List No score
In versions 4.18 and earlier of the Eclipse Platform, the Help Subsystem does not authenticate active help requests to the local help web server, allowing an unauthenticated local attacker to issue active help commands to the associated Eclipse Platform process or Eclipse Rich Client Platform process.
- Record
CVE-2020-27225- Weakness
- CWE-306
- Updated
- 2026-11-02
EUVDEUVD-2020-19738 No score
In versions 4.18 and earlier of the Eclipse Platform, the Help Subsystem does not authenticate active help requests to the local help web server, allowing an unauthenticated local attacker to issue active help commands to the associated Eclipse Platform process or Eclipse Rich Client Platform process.
- Record
EUVD-2020-19738- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9gwg-cvv6-vjxh No score
In versions 4.18 and earlier of the Eclipse Platform, the Help Subsystem does not authenticate...
In versions 4.18 and earlier of the Eclipse Platform, the Help Subsystem does not authenticate active help requests to the local help web server, allowing an unauthenticated local attacker to issue active help commands to the associated Eclipse Platform process or Eclipse Rich Client Platform process.
- Record
GHSA-9gwg-cvv6-vjxh- Weakness
- CWE-306
- Updated
- 2026-11-02
OSVOESA-2022-1759
eclipse security update
The Eclipse platform is designed for building integrated development environments (IDEs), server-side applications, desktop applications, and everything in between.
Security Fix(es):
In versions 4.18 and earlier of the Eclipse Platform, the Help Subsystem does not authenticate active help requests to the local help web server, allowing an unauthenticated local attacker to issue active help commands to the associated Eclipse Platform process or Eclipse Rich Client Platform process.(CVE-2020-27225)
- Record
OESA-2022-1759- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHEA-2021:1441
Red Hat Enhancement Advisory: rh-eclipse bug fix and enhancement update
- Record
RHEA-2021:1441- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2020-27225
In versions 4.18 and earlier of the Eclipse Platform, the Help Subsystem does not authenticate active help requests to the local help web server, allowing an unauthenticated local attacker to issue active help commands to the associated Eclipse Platform process or Eclipse Rich Client Platform process.
- Record
UBUNTU-CVE-2020-27225- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2021-0591 No score
Updated eclipse packages fix security vulnerability
Authenticate active help requests to the local help web server (CVE-2020-27225)
- Record
MGASA-2021-0591- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0485-1 No score
Security update for eclipse
This update for eclipse fixes the following issues:
- CVE-2020-27225: Authenticate active help requests to the local help web server (bsc#1183728).
This update was imported from the SUSE:SLE-15-SP2:Update update project.
- Record
openSUSE-SU-2021:0485-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10732-1 No score
eclipse-contributor-tools-4.15-3.6 on GA media
These are all security issues fixed in the eclipse-contributor-tools-4.15-3.6 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10732-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
eclipseMageia:8 |
before 4.17-8.1.mga8 | 4.17-8.1.mga8 |
eclipseopenEuler:20.03-LTS-SP1 |
before 4.11-4.oe1 | 4.11-4.oe1 |
eclipseopenEuler:20.03-LTS-SP3 |
before 4.11-4.oe1 | 4.11-4.oe1 |
eclipseopenEuler:22.03-LTS |
before 4.11-5.oe2203 | 4.11-5.oe2203 |
rh-eclipseRed Hat:devtools:2021 |
before 1:4.19-4.el7_9 | 1:4.19-4.el7_9 |
rh-eclipse-apache-sshdRed Hat:devtools:2021 |
before 1:2.6.0-1.2.el7_9 | 1:2.6.0-1.2.el7_9 |
rh-eclipse-apache-sshd-javadocRed Hat:devtools:2021 |
before 1:2.6.0-1.2.el7_9 | 1:2.6.0-1.2.el7_9 |
rh-eclipse-batikRed Hat:devtools:2021 |
before 0:1.14-1.1.el7_9 | 0:1.14-1.1.el7_9 |
rh-eclipse-batik-cssRed Hat:devtools:2021 |
before 0:1.14-1.1.el7_9 | 0:1.14-1.1.el7_9 |
rh-eclipse-batik-demoRed Hat:devtools:2021 |
before 0:1.14-1.1.el7_9 | 0:1.14-1.1.el7_9 |
Show 59 moreShow less
| Package | Affected | Fixed |
|---|---|---|
rh-eclipse-batik-javadocRed Hat:devtools:2021 |
before 0:1.14-1.1.el7_9 | 0:1.14-1.1.el7_9 |
rh-eclipse-batik-rasterizerRed Hat:devtools:2021 |
before 0:1.14-1.1.el7_9 | 0:1.14-1.1.el7_9 |
rh-eclipse-batik-slideshowRed Hat:devtools:2021 |
before 0:1.14-1.1.el7_9 | 0:1.14-1.1.el7_9 |
rh-eclipse-batik-squiggleRed Hat:devtools:2021 |
before 0:1.14-1.1.el7_9 | 0:1.14-1.1.el7_9 |
rh-eclipse-batik-svgppRed Hat:devtools:2021 |
before 0:1.14-1.1.el7_9 | 0:1.14-1.1.el7_9 |
rh-eclipse-batik-ttf2svgRed Hat:devtools:2021 |
before 0:1.14-1.1.el7_9 | 0:1.14-1.1.el7_9 |
rh-eclipse-batik-utilRed Hat:devtools:2021 |
before 0:1.14-1.1.el7_9 | 0:1.14-1.1.el7_9 |
rh-eclipse-eclipseRed Hat:devtools:2021 |
before 1:4.19-1.3.el7_9 | 1:4.19-1.3.el7_9 |
rh-eclipse-eclipse-debuginfoRed Hat:devtools:2021 |
before 1:4.19-1.3.el7_9 | 1:4.19-1.3.el7_9 |
rh-eclipse-eclipse-egitRed Hat:devtools:2021 |
before 0:5.11.0-1.1.el7_9 | 0:5.11.0-1.1.el7_9 |
rh-eclipse-eclipse-emfRed Hat:devtools:2021 |
before 1:2.25.0-1.1.el7_9 | 1:2.25.0-1.1.el7_9 |
rh-eclipse-eclipse-emf-coreRed Hat:devtools:2021 |
before 1:2.25.0-1.1.el7_9 | 1:2.25.0-1.1.el7_9 |
rh-eclipse-eclipse-emf-runtimeRed Hat:devtools:2021 |
before 1:2.25.0-1.1.el7_9 | 1:2.25.0-1.1.el7_9 |
rh-eclipse-eclipse-emf-xsdRed Hat:devtools:2021 |
before 1:2.25.0-1.1.el7_9 | 1:2.25.0-1.1.el7_9 |
rh-eclipse-eclipse-equinox-osgiRed Hat:devtools:2021 |
before 1:4.19-1.3.el7_9 | 1:4.19-1.3.el7_9 |
rh-eclipse-eclipse-jdtRed Hat:devtools:2021 |
before 1:4.19-1.3.el7_9 | 1:4.19-1.3.el7_9 |
rh-eclipse-eclipse-jgitRed Hat:devtools:2021 |
before 0:5.11.0-1.1.el7_9 | 0:5.11.0-1.1.el7_9 |
rh-eclipse-eclipse-p2-discoveryRed Hat:devtools:2021 |
before 1:4.19-1.3.el7_9 | 1:4.19-1.3.el7_9 |
rh-eclipse-eclipse-pdeRed Hat:devtools:2021 |
before 1:4.19-1.3.el7_9 | 1:4.19-1.3.el7_9 |
rh-eclipse-eclipse-platformRed Hat:devtools:2021 |
before 1:4.19-1.3.el7_9 | 1:4.19-1.3.el7_9 |
rh-eclipse-eclipse-swtRed Hat:devtools:2021 |
before 1:4.19-1.3.el7_9 | 1:4.19-1.3.el7_9 |
rh-eclipse-jakarta-annotationsRed Hat:devtools:2021 |
before 0:1.3.5-7.1.el7_9 | 0:1.3.5-7.1.el7_9 |
rh-eclipse-jakarta-annotations-javadocRed Hat:devtools:2021 |
before 0:1.3.5-7.1.el7_9 | 0:1.3.5-7.1.el7_9 |
rh-eclipse-jettyRed Hat:devtools:2021 |
before 0:9.4.38-1.1.el7_9 | 0:9.4.38-1.1.el7_9 |
rh-eclipse-jetty-clientRed Hat:devtools:2021 |
before 0:9.4.38-1.1.el7_9 | 0:9.4.38-1.1.el7_9 |
rh-eclipse-jetty-continuationRed Hat:devtools:2021 |
before 0:9.4.38-1.1.el7_9 | 0:9.4.38-1.1.el7_9 |
rh-eclipse-jetty-httpRed Hat:devtools:2021 |
before 0:9.4.38-1.1.el7_9 | 0:9.4.38-1.1.el7_9 |
rh-eclipse-jetty-ioRed Hat:devtools:2021 |
before 0:9.4.38-1.1.el7_9 | 0:9.4.38-1.1.el7_9 |
rh-eclipse-jetty-jaasRed Hat:devtools:2021 |
before 0:9.4.38-1.1.el7_9 | 0:9.4.38-1.1.el7_9 |
rh-eclipse-jetty-javadocRed Hat:devtools:2021 |
before 0:9.4.38-1.1.el7_9 | 0:9.4.38-1.1.el7_9 |
rh-eclipse-jetty-jmxRed Hat:devtools:2021 |
before 0:9.4.38-1.1.el7_9 | 0:9.4.38-1.1.el7_9 |
rh-eclipse-jetty-securityRed Hat:devtools:2021 |
before 0:9.4.38-1.1.el7_9 | 0:9.4.38-1.1.el7_9 |
rh-eclipse-jetty-serverRed Hat:devtools:2021 |
before 0:9.4.38-1.1.el7_9 | 0:9.4.38-1.1.el7_9 |
rh-eclipse-jetty-servletRed Hat:devtools:2021 |
before 0:9.4.38-1.1.el7_9 | 0:9.4.38-1.1.el7_9 |
rh-eclipse-jetty-utilRed Hat:devtools:2021 |
before 0:9.4.38-1.1.el7_9 | 0:9.4.38-1.1.el7_9 |
rh-eclipse-jetty-util-ajaxRed Hat:devtools:2021 |
before 0:9.4.38-1.1.el7_9 | 0:9.4.38-1.1.el7_9 |
rh-eclipse-jetty-webappRed Hat:devtools:2021 |
before 0:9.4.38-1.1.el7_9 | 0:9.4.38-1.1.el7_9 |
rh-eclipse-jetty-xmlRed Hat:devtools:2021 |
before 0:9.4.38-1.1.el7_9 | 0:9.4.38-1.1.el7_9 |
rh-eclipse-jgitRed Hat:devtools:2021 |
before 0:5.11.0-1.1.el7_9 | 0:5.11.0-1.1.el7_9 |
rh-eclipse-jgit-javadocRed Hat:devtools:2021 |
before 0:5.11.0-1.1.el7_9 | 0:5.11.0-1.1.el7_9 |
rh-eclipse-objectweb-asmRed Hat:devtools:2021 |
before 0:9.1-1.1.el7_9 | 0:9.1-1.1.el7_9 |
rh-eclipse-objectweb-asm-javadocRed Hat:devtools:2021 |
before 0:9.1-1.1.el7_9 | 0:9.1-1.1.el7_9 |
rh-eclipse-runtimeRed Hat:devtools:2021 |
before 1:4.19-4.el7_9 | 1:4.19-4.el7_9 |
rh-eclipse-scldevelRed Hat:devtools:2021 |
before 1:4.19-4.el7_9 | 1:4.19-4.el7_9 |
rh-eclipse-takari-polyglotRed Hat:devtools:2021 |
before 0:0.4.6-1.1.el7_9 | 0:0.4.6-1.1.el7_9 |
rh-eclipse-takari-polyglot-atomRed Hat:devtools:2021 |
before 0:0.4.6-1.1.el7_9 | 0:0.4.6-1.1.el7_9 |
rh-eclipse-takari-polyglot-commonRed Hat:devtools:2021 |
before 0:0.4.6-1.1.el7_9 | 0:0.4.6-1.1.el7_9 |
rh-eclipse-takari-polyglot-javadocRed Hat:devtools:2021 |
before 0:0.4.6-1.1.el7_9 | 0:0.4.6-1.1.el7_9 |
rh-eclipse-takari-polyglot-maven-pluginRed Hat:devtools:2021 |
before 0:0.4.6-1.1.el7_9 | 0:0.4.6-1.1.el7_9 |
rh-eclipse-takari-polyglot-translate-pluginRed Hat:devtools:2021 |
before 0:0.4.6-1.1.el7_9 | 0:0.4.6-1.1.el7_9 |
rh-eclipse-takari-polyglot-xmlRed Hat:devtools:2021 |
before 0:0.4.6-1.1.el7_9 | 0:0.4.6-1.1.el7_9 |
rh-eclipse-tychoRed Hat:devtools:2021 |
before 0:2.2.0-4.1.el7_9 | 0:2.2.0-4.1.el7_9 |
rh-eclipse-tycho-javadocRed Hat:devtools:2021 |
before 0:2.2.0-4.1.el7_9 | 0:2.2.0-4.1.el7_9 |
rh-eclipse-xmlgraphics-commonsRed Hat:devtools:2021 |
before 0:2.6-1.1.el7_9 | 0:2.6-1.1.el7_9 |
rh-eclipse-xmlgraphics-commons-javadocRed Hat:devtools:2021 |
before 0:2.6-1.1.el7_9 | 0:2.6-1.1.el7_9 |
eclipseUbuntu:16.04:LTS |
All versions, plus listed versions 3.8.1-8 |
None known |
eclipseUbuntu:18.04:LTS |
All versions, plus listed versions 3.8.1-103.8.1-11 |
None known |
eclipseopenSUSE:Leap 15.2 |
before 4.9.0-lp152.3.3.1 | 4.9.0-lp152.3.3.1 |
eclipse-bootstrapopenSUSE:Leap 15.2 |
before 4.9.0-lp152.3.3.1 | 4.9.0-lp152.3.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-27225 is a high vulnerability (CVSS 7.8) in Eclipse Platform, published March 9, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in eclipse 4.17-8.1.mga8.
References
bugs.eclipse.org/bugs/show_bug.cgi?id=569855
nvd.nist.gov/vuln/detail/CVE-2020-27225
github.com/advisories/GHSA-9gwg-cvv6-vjxh
advisories.mageia.org/MGASA-2021-0591.html
bugs.mageia.org/show_bug.cgi?id=29048
lists.opensuse.org/archives/list/[email protected]/thread/GFMJOYKYZTYC75UCIIQQRAD674LFJI3L
Show 11 moreShow less
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1759
access.redhat.com/errata/RHEA-2021:1441
issues.redhat.com/browse/RHECLIPSE-346
security.access.redhat.com/data/csaf/v2/advisories/2021/rhea-2021_1441.json
bugzilla.redhat.com/show_bug.cgi?id=1939630
cve.org/CVERecord?id=CVE-2020-27225
ubuntu.com/security/CVE-2020-27225
bugzilla.suse.com/1183728
suse.com/security/cve/CVE-2020-27225