Eclipse Memory Analyzer up to 1.14.0 Report Definition xml external entity reference

Summaryinfo

A vulnerability was found in Eclipse Memory Analyzer up to 1.14.0. It has been rated as problematic. This affects an unknown function of the component Report Definition Handler. This manipulation causes xml external entity reference. This vulnerability is tracked as CVE-2023-6194. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability has been found in Eclipse Memory Analyzer up to 1.14.0 and classified as problematic. Affected by this vulnerability is an unknown function of the component Report Definition Handler. The manipulation with an unknown input leads to a xml external entity reference vulnerability. The CWE definition for the vulnerability is CWE-611. The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. As an impact it is known to affect integrity. The summary by CVE is:

In Eclipse Memory Analyzer versions 0.7 to 1.14.0, report definition XML files are not filtered to prohibit document type definition (DTD) references to external entities. This means that if a user chooses to use a malicious report definition XML file containing an external entity reference to generate a report then Eclipse Memory Analyzer may access external files or URLs defined via a DTD in the report definition.

The weakness was disclosed 12/11/2023 as 15. It is possible to read the advisory at gitlab.eclipse.org. This vulnerability is known as CVE-2023-6194 since 11/17/2023. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Eclipse

Name

• Memory Analyzer

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14.0

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion