In Eclipse Theia 0.1.1 to 0.2.0, it is possible to exploit the default build to obtain remote code execution (and XXE) via the theia-xml-extension. This extension uses lsp4xml (recently renamed to LemMinX) in order to provide language support for XML. This is installed by default.
References
Link | Resource |
---|---|
https://bugs.eclipse.org/bugs/show_bug.cgi?id=563174 | Vendor Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: eclipse
Published: 2021-09-02T20:55:10
Updated: 2021-09-02T20:55:09
Reserved: 2021-06-09T00:00:00
Link: CVE-2021-34436
JSON object: View
NVD Information
Status : Analyzed
Published: 2021-09-02T21:15:07.977
Modified: 2021-09-14T13:15:15.633
Link: CVE-2021-34436
JSON object: View
Redhat Information
No data.