Every CVE Search/ Get API key

CVE-2023-4218

XXE in eclipse.platform / Eclipse IDE

5.0 MediumFix available

In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.39%Up 0.3 points since Nov 9, 2023
90%50%10%1%

What each source reports

CVE List Score used 5.0

XXE in eclipse.platform / Eclipse IDE

In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).

Record
CVE-2023-4218
CVSS 3.1
5.0 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-611
Updated
2026-11-02
EUVDEUVD-2023-2980 5.0

In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).

Record
EUVD-2023-2980
CVSS 3.1
5.0 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-j24h-xcpc-9jw8 5.0

Eclipse IDE XXE in eclipse.platform

Impact

xml files like ".project" are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).

Vulnerablility was found by static code analysis (SonarLint).

Example .project file:

<?xml version="1.0" encoding="utf-8"?> 
<!DOCTYPE price [
<!ENTITY xxe SYSTEM "http://127.0.0.1:49416/evil">]>
<projectDescription>
	<name>p</name>
	<comment>&xxe;</comment>
</projectDescription>

Patches

Similar patches including junit test that shows the vulnerability have already applied to PDE (see https://github.com/eclipse-pde/eclipse.pde/pull/667). A solution to platform should be the same: just reject parsing any XML that contains any DOCTYPE.

Workarounds

No known workaround. User can only avoid to get/open any foreign files with eclipse. Firewall rules against loss of data (but not against XML bomb).

References

https://cwe.mitre.org/data/definitions/611.html https://rules.sonarsource.com/java/RSPEC-2755 https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/8 (Report for multiple projects affected)

Record
GHSA-j24h-xcpc-9jw8
CVSS 3.1
5.0 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-02
NVD 5.0

In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).

Record
CVE-2023-4218
CVSS 3.1
5.0 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-611
Updated
2026-11-02
OSV 5.0

XXE in eclipse.platform / Eclipse IDE

In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).

Record
CVE-2023-4218
CVSS 3.1
5.0 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-611
Updated
2026-11-02
OSVGHSA-j24h-xcpc-9jw8 5.0

Eclipse IDE XXE in eclipse.platform

Impact

xml files like ".project" are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).

Vulnerablility was found by static code analysis (SonarLint).

Example .project file:

<?xml version="1.0" encoding="utf-8"?> 
<!DOCTYPE price [
<!ENTITY xxe SYSTEM "http://127.0.0.1:49416/evil">]>
<projectDescription>
	<name>p</name>
	<comment>&xxe;</comment>
</projectDescription>

Patches

Similar patches including junit test that shows the vulnerability have already applied to PDE (see https://github.com/eclipse-pde/eclipse.pde/pull/667). A solution to platform should be the same: just reject parsing any XML that contains any DOCTYPE.

Workarounds

No known workaround. User can only avoid to get/open any foreign files with eclipse. Firewall rules against loss of data (but not against XML bomb).

References

https://cwe.mitre.org/data/definitions/611.html https://rules.sonarsource.com/java/RSPEC-2755 https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/8 (Report for multiple projects affected)

Record
GHSA-j24h-xcpc-9jw8
CVSS 3.1
5.0 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2023-4218 5.0

In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).

Record
UBUNTU-CVE-2023-4218
CVSS 3.1
5.0 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVopenSUSE-SU-2024:13786-1 No score

eclipse-contributor-tools-4.15-13.1 on GA media

These are all security issues fixed in the eclipse-contributor-tools-4.15-13.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13786-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:13787-1 No score

eclipse-emf-core-2.22.0-5.1 on GA media

These are all security issues fixed in the eclipse-emf-core-2.22.0-5.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13787-1
Updated
2026-11-02
OSVSUSE-SU-2024:1304-1 No score

Security update for eclipse, maven-surefire, tycho

This update for eclipse, maven-surefire, tycho fixes the following issues:

eclipse received the following security fix:

  • CVE-2023-4218: Fixed a bug where parsing files with xml content laeds to XXE attacks. (bsc#1216992)

maven-sunfire was updated from version 2.22.0 to 2.22.2:

  • Changes in version 2.22.2:

    • Bugs fixed:

      • Fixed JUnit Runner that writes to System.out corrupts Surefire’s STDOUT when using JUnit’s Vintage Engine

  • Changes in version 2.22.1:

    • Bugs fixed:

      • Fixed Surefire unable to run testng suites in parallel
      • Fixed Git wrongly considering PNG files as changed when there is no change
      • Fixed the surefire XSD published on maven site lacking of some rerun element
      • Fixed XML Report elements rerunError, rerunFailure, flakyFailure, flakyError
      • Fixed overriding platform version through project/plugin dependencies
      • Fixed mixed up characters in standard output
      • Logs in Parallel Tests are mixed up when forkMode=never or forkCount=0
      • MIME type for javascript is now officially application/javascript

    • Improvements:

      • Elapsed time in XML Report should satisfy pattern in XSD.
      • Fix old test resources TEST-*.xml in favor of continuing with SUREFIRE-1550
      • Nil element “failureMessage” in failsafe-summary.xml should have self closed tag
      • Removed obsolete module surefire-setup-integration-tests
      • Support Java 11
      • Surefire should support parameterized reportsDirectory

    • Dependency upgrades:

      • Upgraded maven-plugins parent to version 32
      • Upgraded maven-plugins parent to version 33

tycho received the following bug fixes:

  • Fixed build against maven-surefire 2.22.1 and newer
  • Fixed build against newer plexus-compiler
  • Fixed issues with plexus-archiver 4.4.0 and newer
  • Require explicitely artifacts that will not be required automatically any more
Record
SUSE-SU-2024:1304-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.eclipse.platform:org.eclipse.core.runtime
Maven
 before 3.29.0
3.29.0
org.eclipse.platform:org.eclipse.platform
Maven
 before 4.29.0
4.29.0
org.eclipse.platform:org.eclipse.jface
Maven
 before 3.31.0
3.31.0
org.eclipse.platform:org.eclipse.ui.forms
Maven
 before 3.13.0
3.13.0
org.eclipse.platform:org.eclipse.ui.ide
Maven
 before 3.21.100
3.21.100
org.eclipse.platform:org.eclipse.ui.workbench
Maven
 before 3.130.0
3.130.0
org.eclipse.platform:org.eclipse.urischeme
Maven
 before 1.3.100
1.3.100
org.eclipse.jdt:org.eclipse.jdt.ui
Maven
 before 3.30.0
3.30.0
org.eclipse.platform:org.eclipse.core.runtime
Maven
 before 3.29.0, plus listed versions
3.12.03.13.03.14.03.15.03.15.100
Show 17 moreShow less
3.15.2003.15.3003.16.03.17.03.17.1003.18.03.19.03.20.03.20.1003.22.03.23.03.24.03.24.1003.25.03.26.03.26.1003.27.0
3.29.0
org.eclipse.platform:org.eclipse.platform
Maven
 before 4.29.0, plus listed versions
4.10.04.11.04.12.04.13.04.14.0
Show 22 moreShow less
4.15.04.16.04.17.04.18.04.19.04.20.04.21.04.22.04.23.04.24.04.25.04.26.04.27.04.28.04.6.24.6.34.7.04.7.14.7.24.7.34.8.04.9.0
4.29.0
Show 45 moreShow less
Affected packages
PackageAffectedFixed
org.eclipse.platform:org.eclipse.jface
Maven
 before 3.31.0, plus listed versions
3.12.13.12.23.13.03.13.13.13.2
Show 21 moreShow less
3.14.03.14.1003.15.03.15.1003.16.03.17.03.18.03.19.03.20.03.21.03.22.03.22.1003.22.2003.23.03.24.03.25.03.26.03.27.03.28.03.29.03.30.0
3.31.0
org.eclipse.platform:org.eclipse.ui.forms
Maven
 before 3.13.0, plus listed versions
3.10.03.11.03.11.1003.11.2003.11.300
Show 17 moreShow less
3.11.4003.11.5003.11.6003.12.03.7.03.7.13.7.1003.7.1013.7.2003.7.3003.7.4003.7.5003.8.03.8.1003.8.2003.9.03.9.100
3.13.0
org.eclipse.platform:org.eclipse.ui.ide
Maven
 before 3.21.100, plus listed versions
3.12.23.12.33.13.03.13.13.14.0
Show 20 moreShow less
3.14.1003.14.2003.15.03.15.2003.16.03.16.1003.17.03.17.1003.17.2003.18.03.18.1003.18.2003.18.3003.18.4003.18.5003.19.03.19.1003.20.03.20.1003.21.0
3.21.100
org.eclipse.platform:org.eclipse.ui.workbench
Maven
 before 3.130.0, plus listed versions
3.108.23.108.33.110.03.110.13.111.0
Show 20 moreShow less
3.112.03.112.1003.113.03.115.03.116.03.117.03.118.03.119.03.120.03.122.03.122.1003.122.2003.123.03.124.03.125.03.125.1003.126.03.127.03.128.03.129.0
3.130.0
org.eclipse.platform:org.eclipse.urischeme
Maven
 before 1.3.100, plus listed versions
1.0.01.0.1001.0.2001.0.3001.0.400
Show 12 moreShow less
1.0.5001.0.6001.1.01.1.1001.1.2001.1.3001.1.4001.2.01.2.1001.2.2001.2.3001.3.0
1.3.100
org.eclipse.jdt:org.eclipse.jdt.ui
Maven
 before 3.30.0, plus listed versions
3.12.23.13.03.13.1003.13.503.13.51
Show 22 moreShow less
3.13.523.14.03.15.03.16.03.17.03.18.03.19.03.20.03.21.03.21.1003.21.2003.22.03.22.1003.23.03.24.03.25.03.26.03.26.1003.27.03.27.1003.28.03.29.0
3.30.0
maven-surefire
SUSE:Linux Enterprise Module for Development Tools 15 SP5
 before 2.22.2-150200.3.9.9.1
2.22.2-150200.3.9.9.1
maven-surefire-plugins
SUSE:Linux Enterprise Module for Development Tools 15 SP5
 before 2.22.2-150200.3.9.9.1
2.22.2-150200.3.9.9.1
eclipse
SUSE:Linux Enterprise Module for Package Hub 15 SP5
 before 4.15-150200.4.16.4
4.15-150200.4.16.4
eclipse-bootstrap
SUSE:Linux Enterprise Module for Package Hub 15 SP5
 before 4.15-150200.4.16.5
4.15-150200.4.16.5
eclipse-emf
SUSE:Linux Enterprise Module for Package Hub 15 SP5
 before 2.22.0-150200.4.9.3
2.22.0-150200.4.9.3
eclipse-emf-bootstrap
SUSE:Linux Enterprise Module for Package Hub 15 SP5
 before 2.22.0-150200.4.9.3
2.22.0-150200.4.9.3
maven-surefire
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
 before 2.22.2-150200.3.9.9.1
2.22.2-150200.3.9.9.1
maven-surefire-plugins
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
 before 2.22.2-150200.3.9.9.1
2.22.2-150200.3.9.9.1
maven-surefire
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
 before 2.22.2-150200.3.9.9.1
2.22.2-150200.3.9.9.1
maven-surefire-plugins
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
 before 2.22.2-150200.3.9.9.1
2.22.2-150200.3.9.9.1
maven-surefire
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
 before 2.22.2-150200.3.9.9.1
2.22.2-150200.3.9.9.1
maven-surefire-plugins
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
 before 2.22.2-150200.3.9.9.1
2.22.2-150200.3.9.9.1
maven-surefire
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
 before 2.22.2-150200.3.9.9.1
2.22.2-150200.3.9.9.1
maven-surefire-plugins
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
 before 2.22.2-150200.3.9.9.1
2.22.2-150200.3.9.9.1
maven-surefire
SUSE:Linux Enterprise Server 15 SP2-LTSS
 before 2.22.2-150200.3.9.9.1
2.22.2-150200.3.9.9.1
maven-surefire-plugins
SUSE:Linux Enterprise Server 15 SP2-LTSS
 before 2.22.2-150200.3.9.9.1
2.22.2-150200.3.9.9.1
maven-surefire
SUSE:Linux Enterprise Server 15 SP3-LTSS
 before 2.22.2-150200.3.9.9.1
2.22.2-150200.3.9.9.1
maven-surefire-plugins
SUSE:Linux Enterprise Server 15 SP3-LTSS
 before 2.22.2-150200.3.9.9.1
2.22.2-150200.3.9.9.1
maven-surefire
SUSE:Linux Enterprise Server 15 SP4-LTSS
 before 2.22.2-150200.3.9.9.1
2.22.2-150200.3.9.9.1
maven-surefire-plugins
SUSE:Linux Enterprise Server 15 SP4-LTSS
 before 2.22.2-150200.3.9.9.1
2.22.2-150200.3.9.9.1
maven-surefire
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
 before 2.22.2-150200.3.9.9.1
2.22.2-150200.3.9.9.1
maven-surefire-plugins
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
 before 2.22.2-150200.3.9.9.1
2.22.2-150200.3.9.9.1
maven-surefire
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
 before 2.22.2-150200.3.9.9.1
2.22.2-150200.3.9.9.1
maven-surefire-plugins
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
 before 2.22.2-150200.3.9.9.1
2.22.2-150200.3.9.9.1
maven-surefire
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
 before 2.22.2-150200.3.9.9.1
2.22.2-150200.3.9.9.1
maven-surefire-plugins
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
 before 2.22.2-150200.3.9.9.1
2.22.2-150200.3.9.9.1
maven-surefire
SUSE:Enterprise Storage 7.1
 before 2.22.2-150200.3.9.9.1
2.22.2-150200.3.9.9.1
maven-surefire-plugins
SUSE:Enterprise Storage 7.1
 before 2.22.2-150200.3.9.9.1
2.22.2-150200.3.9.9.1
eclipse
openSUSE:Leap 15.5
 before 4.15-150200.4.16.4
4.15-150200.4.16.4
eclipse-bootstrap
openSUSE:Leap 15.5
 before 4.15-150200.4.16.5
4.15-150200.4.16.5
eclipse-emf
openSUSE:Leap 15.5
 before 2.22.0-150200.4.9.3
2.22.0-150200.4.9.3
eclipse-emf-bootstrap
openSUSE:Leap 15.5
 before 2.22.0-150200.4.9.3
2.22.0-150200.4.9.3
maven-surefire
openSUSE:Leap 15.5
 before 2.22.2-150200.3.9.9.1
2.22.2-150200.3.9.9.1
maven-surefire-plugins
openSUSE:Leap 15.5
 before 2.22.2-150200.3.9.9.1
2.22.2-150200.3.9.9.1
maven-surefire-provider-junit5
openSUSE:Leap 15.5
 before 2.22.2-150200.3.9.9.1
2.22.2-150200.3.9.9.1
tycho
openSUSE:Leap 15.5
 before 1.6.0-150200.4.9.5
1.6.0-150200.4.9.5
tycho-bootstrap
openSUSE:Leap 15.5
 before 1.6.0-150200.4.9.2
1.6.0-150200.4.9.2
eclipse
Ubuntu:16.04:LTS
 All versions, plus listed versions
3.8.1-8
 None known
eclipse
Ubuntu:18.04:LTS
 All versions, plus listed versions
3.8.1-103.8.1-11
 None known

History

History
RecordedChangedSources
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-4218 is a medium vulnerability (CVSS 5.0) in Eclipse Ide, published November 9, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. Fixed in org.eclipse.platform:org.eclipse.core.runtime 3.29.0.

References

Show 16 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open