{"id":"CVE-2023-4218","aliases":["EUVD-2023-2980","GHSA-j24h-xcpc-9jw8","SUSE-SU-2024:1304-1","UBUNTU-CVE-2023-4218","openSUSE-SU-2024:13786-1","openSUSE-SU-2024:13787-1"],"status":"published","title":"XXE in eclipse.platform / Eclipse IDE","description":"In Eclipse IDE versions \u003c 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).","severity":{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00402,"percentile":0.34811,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-611"],"published":"2023-11-09T08:26:51Z","modified":"2026-10-28T10:41:02Z","fixes":[{"ecosystem":"Maven","package":"org.eclipse.platform:org.eclipse.core.runtime","fixed_in":["3.29.0"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.eclipse.platform:org.eclipse.platform","fixed_in":["4.29.0"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.eclipse.platform:org.eclipse.jface","fixed_in":["3.31.0"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.eclipse.platform:org.eclipse.ui.forms","fixed_in":["3.13.0"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.eclipse.platform:org.eclipse.ui.ide","fixed_in":["3.21.100"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.eclipse.platform:org.eclipse.ui.workbench","fixed_in":["3.130.0"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.eclipse.platform:org.eclipse.urischeme","fixed_in":["1.3.100"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.eclipse.jdt:org.eclipse.jdt.ui","fixed_in":["3.30.0"],"sources":["ghsa","osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"maven-surefire","fixed_in":["2.22.2-150200.3.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"maven-surefire-plugins","fixed_in":["2.22.2-150200.3.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"eclipse","fixed_in":["4.15-150200.4.16.4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"eclipse-bootstrap","fixed_in":["4.15-150200.4.16.5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"eclipse-emf","fixed_in":["2.22.0-150200.4.9.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"eclipse-emf-bootstrap","fixed_in":["2.22.0-150200.4.9.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"maven-surefire","fixed_in":["2.22.2-150200.3.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"maven-surefire-plugins","fixed_in":["2.22.2-150200.3.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"maven-surefire","fixed_in":["2.22.2-150200.3.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"maven-surefire-plugins","fixed_in":["2.22.2-150200.3.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"maven-surefire","fixed_in":["2.22.2-150200.3.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"maven-surefire-plugins","fixed_in":["2.22.2-150200.3.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"maven-surefire","fixed_in":["2.22.2-150200.3.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"maven-surefire-plugins","fixed_in":["2.22.2-150200.3.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"maven-surefire","fixed_in":["2.22.2-150200.3.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"maven-surefire-plugins","fixed_in":["2.22.2-150200.3.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"maven-surefire","fixed_in":["2.22.2-150200.3.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"maven-surefire-plugins","fixed_in":["2.22.2-150200.3.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"maven-surefire","fixed_in":["2.22.2-150200.3.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"maven-surefire-plugins","fixed_in":["2.22.2-150200.3.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"maven-surefire","fixed_in":["2.22.2-150200.3.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"maven-surefire-plugins","fixed_in":["2.22.2-150200.3.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"maven-surefire","fixed_in":["2.22.2-150200.3.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"maven-surefire-plugins","fixed_in":["2.22.2-150200.3.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"maven-surefire","fixed_in":["2.22.2-150200.3.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"maven-surefire-plugins","fixed_in":["2.22.2-150200.3.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"maven-surefire","fixed_in":["2.22.2-150200.3.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"maven-surefire-plugins","fixed_in":["2.22.2-150200.3.9.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"eclipse","fixed_in":["4.15-150200.4.16.4"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"eclipse-bootstrap","fixed_in":["4.15-150200.4.16.5"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"eclipse-emf","fixed_in":["2.22.0-150200.4.9.3"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"eclipse-emf-bootstrap","fixed_in":["2.22.0-150200.4.9.3"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"maven-surefire","fixed_in":["2.22.2-150200.3.9.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"maven-surefire-plugins","fixed_in":["2.22.2-150200.3.9.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"maven-surefire-provider-junit5","fixed_in":["2.22.2-150200.3.9.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"tycho","fixed_in":["1.6.0-150200.4.9.5"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"tycho-bootstrap","fixed_in":["1.6.0-150200.4.9.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.platform:org.eclipse.core.runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.29.0"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.platform:org.eclipse.platform","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.29.0"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.platform:org.eclipse.jface","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.31.0"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.platform:org.eclipse.ui.forms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.0"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.platform:org.eclipse.ui.ide","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.100"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.platform:org.eclipse.ui.workbench","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.130.0"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.platform:org.eclipse.urischeme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.100"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jdt:org.eclipse.jdt.ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.30.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.platform:org.eclipse.core.runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.29.0"}]}],"versions":["3.12.0","3.13.0","3.14.0","3.15.0","3.15.100","3.15.200","3.15.300","3.16.0","3.17.0","3.17.100","3.18.0","3.19.0","3.20.0","3.20.100","3.22.0","3.23.0","3.24.0","3.24.100","3.25.0","3.26.0","3.26.100","3.27.0"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.platform:org.eclipse.platform","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.29.0"}]}],"versions":["4.10.0","4.11.0","4.12.0","4.13.0","4.14.0","4.15.0","4.16.0","4.17.0","4.18.0","4.19.0","4.20.0","4.21.0","4.22.0","4.23.0","4.24.0","4.25.0","4.26.0","4.27.0","4.28.0","4.6.2","4.6.3","4.7.0","4.7.1","4.7.2","4.7.3","4.8.0","4.9.0"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.platform:org.eclipse.jface","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.31.0"}]}],"versions":["3.12.1","3.12.2","3.13.0","3.13.1","3.13.2","3.14.0","3.14.100","3.15.0","3.15.100","3.16.0","3.17.0","3.18.0","3.19.0","3.20.0","3.21.0","3.22.0","3.22.100","3.22.200","3.23.0","3.24.0","3.25.0","3.26.0","3.27.0","3.28.0","3.29.0","3.30.0"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.platform:org.eclipse.ui.forms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.0"}]}],"versions":["3.10.0","3.11.0","3.11.100","3.11.200","3.11.300","3.11.400","3.11.500","3.11.600","3.12.0","3.7.0","3.7.1","3.7.100","3.7.101","3.7.200","3.7.300","3.7.400","3.7.500","3.8.0","3.8.100","3.8.200","3.9.0","3.9.100"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.platform:org.eclipse.ui.ide","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.100"}]}],"versions":["3.12.2","3.12.3","3.13.0","3.13.1","3.14.0","3.14.100","3.14.200","3.15.0","3.15.200","3.16.0","3.16.100","3.17.0","3.17.100","3.17.200","3.18.0","3.18.100","3.18.200","3.18.300","3.18.400","3.18.500","3.19.0","3.19.100","3.20.0","3.20.100","3.21.0"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.platform:org.eclipse.ui.workbench","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.130.0"}]}],"versions":["3.108.2","3.108.3","3.110.0","3.110.1","3.111.0","3.112.0","3.112.100","3.113.0","3.115.0","3.116.0","3.117.0","3.118.0","3.119.0","3.120.0","3.122.0","3.122.100","3.122.200","3.123.0","3.124.0","3.125.0","3.125.100","3.126.0","3.127.0","3.128.0","3.129.0"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.platform:org.eclipse.urischeme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.100"}]}],"versions":["1.0.0","1.0.100","1.0.200","1.0.300","1.0.400","1.0.500","1.0.600","1.1.0","1.1.100","1.1.200","1.1.300","1.1.400","1.2.0","1.2.100","1.2.200","1.2.300","1.3.0"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jdt:org.eclipse.jdt.ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.30.0"}]}],"versions":["3.12.2","3.13.0","3.13.100","3.13.50","3.13.51","3.13.52","3.14.0","3.15.0","3.16.0","3.17.0","3.18.0","3.19.0","3.20.0","3.21.0","3.21.100","3.21.200","3.22.0","3.22.100","3.23.0","3.24.0","3.25.0","3.26.0","3.26.100","3.27.0","3.27.100","3.28.0","3.29.0"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"maven-surefire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22.2-150200.3.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"maven-surefire-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22.2-150200.3.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"eclipse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-150200.4.16.4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"eclipse-bootstrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-150200.4.16.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"eclipse-emf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22.0-150200.4.9.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"eclipse-emf-bootstrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22.0-150200.4.9.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"maven-surefire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22.2-150200.3.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"maven-surefire-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22.2-150200.3.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"maven-surefire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22.2-150200.3.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"maven-surefire-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22.2-150200.3.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"maven-surefire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22.2-150200.3.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"maven-surefire-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22.2-150200.3.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"maven-surefire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22.2-150200.3.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"maven-surefire-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22.2-150200.3.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"maven-surefire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22.2-150200.3.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"maven-surefire-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22.2-150200.3.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"maven-surefire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22.2-150200.3.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"maven-surefire-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22.2-150200.3.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"maven-surefire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22.2-150200.3.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"maven-surefire-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22.2-150200.3.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"maven-surefire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22.2-150200.3.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"maven-surefire-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22.2-150200.3.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"maven-surefire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22.2-150200.3.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"maven-surefire-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22.2-150200.3.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"maven-surefire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22.2-150200.3.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"maven-surefire-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22.2-150200.3.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"maven-surefire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22.2-150200.3.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"maven-surefire-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22.2-150200.3.9.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"eclipse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-150200.4.16.4"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"eclipse-bootstrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-150200.4.16.5"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"eclipse-emf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22.0-150200.4.9.3"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"eclipse-emf-bootstrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22.0-150200.4.9.3"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"maven-surefire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22.2-150200.3.9.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"maven-surefire-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22.2-150200.3.9.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"maven-surefire-provider-junit5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22.2-150200.3.9.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"tycho","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-150200.4.9.5"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"tycho-bootstrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-150200.4.9.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"eclipse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.1-8"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"eclipse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.1-10","3.8.1-11"]}],"products":[{"vendor":"eclipse","product":"eclipse_ide"},{"vendor":"eclipse","product":"org.eclipse.core.runtime"},{"vendor":"eclipse","product":"pde"},{"vendor":"eclipse foundation","product":"eclipse ide"},{"vendor":"eclipse foundation","product":"org.eclipse.core.runtime"},{"vendor":"eclipse foundation","product":"org.eclipse.pde"}],"references":[{"url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/8","tags":["x_transferred","Exploit","Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://github.com/eclipse-pde/eclipse.pde/pull/632/","tags":["x_transferred","Patch","web","report"]},{"url":"https://github.com/eclipse-pde/eclipse.pde/pull/667/","tags":["x_transferred","Patch","web","report"]},{"url":"https://github.com/eclipse-platform/eclipse.platform/pull/761","tags":["x_transferred","Patch","fix","web","report"]},{"url":"https://github.com/eclipse-platform/eclipse.platform.releng.buildtools/pull/45","tags":["x_transferred","Patch","fix","web","report"]},{"url":"https://github.com/eclipse-platform/eclipse.platform.ui/commit/f243cf0a28785b89b7c50bf4e1cce48a917d89bd","tags":["x_transferred","Patch","fix","web","report"]},{"url":"https://github.com/eclipse-jdt/eclipse.jdt.ui/commit/13675b1f8a74f47de4da89ed0ded6af7c21dfbec","tags":["x_transferred","Patch","fix","web","report"]},{"url":"https://github.com/eclipse-jdt/eclipse.jdt.core/commit/38dd2a878f45cdb3d8d52090f1d6d1b532fd4c4d","tags":["x_transferred","Patch","fix","web","report"]},{"url":"https://github.com/eclipse-emf/org.eclipse.emf/issues/10","tags":["x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://github.com/eclipse-platform/eclipse.platform.swt/commit/bf71db5ddcb967c0863dad4745367b54f49e06ba","tags":["x_transferred","Patch","fix","web","report"]},{"url":"https://github.com/eclipse-cdt/cdt/commit/c7169b3186d2fef20f97467c3e2ad78e2943ed1b","tags":["x_transferred","Patch","fix","web","report"]},{"url":"https://github.com/eclipse-platform/eclipse.platform/security/advisories/GHSA-j24h-xcpc-9jw8","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4218","tags":["advisory"]},{"url":"https://github.com/eclipse-platform/eclipse.platform/commit/5dc372a0c5002b7f22e5d49eaa1cbf0916455daf","tags":["web"]},{"url":"https://github.com/eclipse-pde/eclipse.pde/pull/632","tags":["web"]},{"url":"https://github.com/eclipse-pde/eclipse.pde/pull/667","tags":["web"]},{"url":"https://github.com/advisories/GHSA-j24h-xcpc-9jw8"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/4xxx/CVE-2023-4218.json","tags":["advisory"]},{"url":"https://github.com/eclipse-platform/eclipse.platform","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241304-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1216992","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-4218","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-4218","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-4218","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-4218","title":"XXE in eclipse.platform / Eclipse IDE","description":"In Eclipse IDE versions \u003c 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).\n","status":"published","published":"2023-11-09T08:26:51.567Z","modified":"2024-09-03T19:26:14.225Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:35:30.851125Z"}],"euvd":[{"id":"EUVD-2023-2980","description":"In Eclipse IDE versions \u003c 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).\n","status":"published","published":"2023-11-09T08:26:51Z","modified":"2024-09-03T19:26:14Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:56:05.029422Z"}],"ghsa":[{"id":"GHSA-j24h-xcpc-9jw8","title":"Eclipse IDE XXE in eclipse.platform","description":"### Impact\nxml files like \".project\" are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review  a foreign repository or patch).\n\nVulnerablility was found by static code analysis (SonarLint).\n\nExample `.project` file:\n```\n\u003c?xml version=\"1.0\" encoding=\"utf-8\"?\u003e \n\u003c!DOCTYPE price [\n\u003c!ENTITY xxe SYSTEM \"http://127.0.0.1:49416/evil\"\u003e]\u003e\n\u003cprojectDescription\u003e\n\t\u003cname\u003ep\u003c/name\u003e\n\t\u003ccomment\u003e\u0026xxe;\u003c/comment\u003e\n\u003c/projectDescription\u003e\n```\n\n### Patches\nSimilar patches including junit test that shows the vulnerability have already applied to PDE (see https://github.com/eclipse-pde/eclipse.pde/pull/667). A solution to platform should be the same: just reject parsing any XML that contains any `DOCTYPE`.\n\n### Workarounds\nNo known workaround. User can only avoid to get/open any foreign files with eclipse. Firewall rules against loss of data (but not against XML bomb).\n\n### References\nhttps://cwe.mitre.org/data/definitions/611.html\nhttps://rules.sonarsource.com/java/RSPEC-2755\nhttps://gitlab.eclipse.org/security/vulnerability-reports/-/issues/8 (Report for multiple projects affected)\n\n","status":"published","published":"2023-11-30T19:52:54Z","modified":"2024-03-05T21:36:57Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T14:37:39.730152Z"}],"nvd":[{"id":"CVE-2023-4218","description":"In Eclipse IDE versions \u003c 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).\n","status":"published","published":"2023-11-09T09:15:08.32Z","modified":"2026-06-17T06:37:20.477Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:08:43.669554Z"}],"osv":[{"id":"CVE-2023-4218","title":"XXE in eclipse.platform / Eclipse IDE","description":"In Eclipse IDE versions \u003c 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).\n","status":"published","published":"2023-11-09T08:26:51.567Z","modified":"2026-10-28T10:41:02.153024314Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:44:33.792101Z"},{"id":"GHSA-j24h-xcpc-9jw8","title":"Eclipse IDE XXE in eclipse.platform","description":"### Impact\nxml files like \".project\" are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review  a foreign repository or patch).\n\nVulnerablility was found by static code analysis (SonarLint).\n\nExample `.project` file:\n```\n\u003c?xml version=\"1.0\" encoding=\"utf-8\"?\u003e \n\u003c!DOCTYPE price [\n\u003c!ENTITY xxe SYSTEM \"http://127.0.0.1:49416/evil\"\u003e]\u003e\n\u003cprojectDescription\u003e\n\t\u003cname\u003ep\u003c/name\u003e\n\t\u003ccomment\u003e\u0026xxe;\u003c/comment\u003e\n\u003c/projectDescription\u003e\n```\n\n### Patches\nSimilar patches including junit test that shows the vulnerability have already applied to PDE (see https://github.com/eclipse-pde/eclipse.pde/pull/667). A solution to platform should be the same: just reject parsing any XML that contains any `DOCTYPE`.\n\n### Workarounds\nNo known workaround. User can only avoid to get/open any foreign files with eclipse. Firewall rules against loss of data (but not against XML bomb).\n\n### References\nhttps://cwe.mitre.org/data/definitions/611.html\nhttps://rules.sonarsource.com/java/RSPEC-2755\nhttps://gitlab.eclipse.org/security/vulnerability-reports/-/issues/8 (Report for multiple projects affected)\n\n","status":"published","published":"2023-11-30T19:52:54Z","modified":"2024-12-03T06:08:39.967584Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:46:49.621585Z"},{"id":"UBUNTU-CVE-2023-4218","description":"In Eclipse IDE versions \u003c 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).","status":"published","published":"2023-11-09T09:15:00Z","modified":"2025-10-24T05:01:31Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"},{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"openSUSE-SU-2024:13786-1","title":"eclipse-contributor-tools-4.15-13.1 on GA media","description":"These are all security issues fixed in the eclipse-contributor-tools-4.15-13.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:37:03.935207Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2024:13787-1","title":"eclipse-emf-core-2.22.0-5.1 on GA media","description":"These are all security issues fixed in the eclipse-emf-core-2.22.0-5.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:07:44.756361Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2024:1304-1","title":"Security update for eclipse, maven-surefire, tycho","description":"This update for eclipse, maven-surefire, tycho fixes the following issues:\n\neclipse received the following security fix:\n\n- CVE-2023-4218: Fixed a bug where parsing files with xml content laeds to XXE attacks. (bsc#1216992)\n\nmaven-sunfire was updated from version 2.22.0 to 2.22.2:\n\n- Changes in version 2.22.2:\n\n  * Bugs fixed:\n\n    + Fixed JUnit Runner that writes to System.out corrupts Surefire’s STDOUT when using JUnit’s Vintage\n      Engine\n\n- Changes in version 2.22.1:\n\n  * Bugs fixed:\n\n    + Fixed Surefire unable to run testng suites in parallel\n    + Fixed Git wrongly considering PNG files as changed when there is no change\n    + Fixed the surefire XSD published on maven site lacking of some rerun element\n    + Fixed XML Report elements rerunError, rerunFailure, flakyFailure, flakyError\n    + Fixed overriding platform version through project/plugin dependencies\n    + Fixed mixed up characters in standard output\n    + Logs in Parallel Tests are mixed up when `forkMode=never` or `forkCount=0`\n    + MIME type for javascript is now officially application/javascript\n\n  * Improvements:\n\n    + Elapsed time in XML Report should satisfy pattern in XSD.\n    + Fix old test resources TEST-*.xml in favor of continuing with SUREFIRE-1550\n    + Nil element “failureMessage” in failsafe-summary.xml should have self closed tag\n    + Removed obsolete module `surefire-setup-integration-tests`\n    + Support Java 11\n    + Surefire should support parameterized reportsDirectory\n\n  * Dependency upgrades:\n\n    + Upgraded maven-plugins parent to version 32\n    + Upgraded maven-plugins parent to version 33\n\ntycho received the following bug fixes:\n\n- Fixed build against maven-surefire 2.22.1 and newer\n- Fixed build against newer plexus-compiler\n- Fixed issues with plexus-archiver 4.4.0 and newer\n- Require explicitely artifacts that will not be required automatically any more\n","status":"published","published":"2024-04-16T09:00:06Z","modified":"2026-02-04T04:09:25.581075Z","updated_at":"2026-11-02T15:53:54.652421Z"}]}}