CVE-2019-17637

State: Published
Severity: Not scored
Published: Jul 15, 2020
Updated: Aug 5, 2024
Reserved: Oct 16, 2019

Description

In all versions of Eclipse Web Tools Platform through release 3.18 (2020-06), XML and DTD files referring to external entities could be exploited to send the contents of local files to a remote server when edited or validated, even when external entity resolution is disabled in the user preferences.

Scores

The record has no CVSS score.

Weaknesses

CWE-611 Improper Restriction of XML External Entity Reference (XXE)

Affected Products

Product	Versions
Eclipse Web Tools PlatformThe Eclipse Foundation	1.0 to 3.18Affected

References

https://bugs.eclipse.org/bugs/show_bug.cgi?id=458571
[debian-lts-announce] 20201009 [SECURITY] [DLA 2404-1] eclipse-wtp security updatemailing-list

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.