Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-4218

In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).

Security Impact Summary

This vulnerability carries a MEDIUM severity rating with a CVSS v3.1 score of 5.0, requiring local system access to exploit with relatively low complexity though user interaction is required requiring only low-level privileges . The vulnerability impacts confidentiality (data exposure), for affected systems. Impacting 3 products from eclipse, from eclipse, from eclipse organizations running these solutions should prioritize assessment and patching.

Historical Context

Reported in 2023, this vulnerability emerged during an era marked by increased sophistication in supply chain attacks, cloud infrastructure vulnerabilities, and software-as-a-service (SaaS) security challenges. Security practices during this period emphasized zero-trust architectures, container security, and API protection.

Published

2023-11-09T09:15:08.320

Last Modified

2026-06-17T06:37:20.477

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.0 (MEDIUM)

Weaknesses

Type: Secondary
CWE-611
Type: Primary
CWE-611

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	eclipse	eclipse_ide	< 4.29	Yes
Application	eclipse	org.eclipse.core.runtime	< 3.29.0	Yes
Application	eclipse	pde	< 3.13.2400	Yes

References

https://github.com/eclipse-cdt/cdt/commit/c7169b3186d2fef20f97467c3e2ad78e2943ed1b Patch ([email protected])
https://github.com/eclipse-emf/org.eclipse.emf/issues/10 Issue Tracking, Third Party Advisory ([email protected])
https://github.com/eclipse-jdt/eclipse.jdt.core/commit/38dd2a878f45cdb3d8d52090f1d6d1b532fd4c4d Patch ([email protected])
https://github.com/eclipse-jdt/eclipse.jdt.ui/commit/13675b1f8a74f47de4da89ed0ded6af7c21dfbec Patch ([email protected])
https://github.com/eclipse-pde/eclipse.pde/pull/632/ Patch ([email protected])
https://github.com/eclipse-pde/eclipse.pde/pull/667/ Patch ([email protected])
https://github.com/eclipse-platform/eclipse.platform.releng.buildtools/pull/45 Patch ([email protected])
https://github.com/eclipse-platform/eclipse.platform.swt/commit/bf71db5ddcb967c0863dad4745367b54f49e06ba Patch ([email protected])
https://github.com/eclipse-platform/eclipse.platform.ui/commit/f243cf0a28785b89b7c50bf4e1cce48a917d89bd Patch ([email protected])
https://github.com/eclipse-platform/eclipse.platform/pull/761 Patch ([email protected])
https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/8 Exploit, Issue Tracking, Vendor Advisory ([email protected])
https://github.com/eclipse-cdt/cdt/commit/c7169b3186d2fef20f97467c3e2ad78e2943ed1b Patch (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/eclipse-emf/org.eclipse.emf/issues/10 Issue Tracking, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/eclipse-jdt/eclipse.jdt.core/commit/38dd2a878f45cdb3d8d52090f1d6d1b532fd4c4d Patch (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/eclipse-jdt/eclipse.jdt.ui/commit/13675b1f8a74f47de4da89ed0ded6af7c21dfbec Patch (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/eclipse-pde/eclipse.pde/pull/632/ Patch (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/eclipse-pde/eclipse.pde/pull/667/ Patch (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/eclipse-platform/eclipse.platform.releng.buildtools/pull/45 Patch (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/eclipse-platform/eclipse.platform.swt/commit/bf71db5ddcb967c0863dad4745367b54f49e06ba Patch (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/eclipse-platform/eclipse.platform.ui/commit/f243cf0a28785b89b7c50bf4e1cce48a917d89bd Patch (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/eclipse-platform/eclipse.platform/pull/761 Patch (af854a3a-2127-422b-91ae-364da2661108)
https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/8 Exploit, Issue Tracking, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)

How SecUtils Interprets This CVE

SecUtils normalizes and enriches National Vulnerability Database (NVD) records by standardizing vendor and product identifiers, aggregating vulnerability metadata from both NVD and MITRE sources, and providing structured context for security teams. For eclipse's affected products, we extract Common Platform Enumeration (CPE) data, Common Weakness Enumeration (CWE) classifications, CVSS severity metrics, and reference data to enable rapid vulnerability prioritization and asset correlation. This record contains no exploit code, proof-of-concept instructions, or attack methodologies—only defensive intelligence necessary for patch management, risk assessment, and security operations.