CVE-2020-27225

Published: Mar 9, 2021Modified: Nov 21, 2024

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

In versions 4.18 and earlier of the Eclipse Platform, the Help Subsystem does not authenticate active help requests to the local help web server, allowing an unauthenticated local attacker to issue active help commands to the associated Eclipse Platform process or Eclipse Rich Client Platform process.

Affected (1)

Products: Eclipse: Platform

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Eclipse Platform	Up to 4.18

Related CWEs

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (2)

https://bugs.eclipse.org/bugs/show_bug.cgi?id=569855

Source: emo@eclipse.org

ExploitIssue TrackingPatchVendor Advisory

https://bugs.eclipse.org/bugs/show_bug.cgi?id=569855

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue TrackingPatchVendor Advisory

Timeline

No history available yet.