Bugzilla – Bug 654596
VUL-1: eclipse: Help Server Local Cross Site Scripting (XSS) Vulnerability
Last modified: 2016-04-27 18:58:34 UTC
There is a security bug in package 'eclipse'.
This bug is public.
There is no coordinated release date (CRD) set.
More information can be found here:
---------- Weitergeleitete Nachricht ----------
Betreff: Eclipse IDE | Help Server Local Cross Site Scripting (XSS)
Datum: Dienstag 16 November 2010
Von: YGN Ethical Hacker Group <email@example.com>
An: firstname.lastname@example.org, email@example.com,
firstname.lastname@example.org, email@example.com, firstname.lastname@example.org,
Eclipse IDE | Help Server Local Cross Site Scripting (XSS) Vulnerability
The Help Content web application of Eclipse IDE was vulnerable to
Cross Site Scripting (XSS) Vulnerability.
2. PRODUCT DESCRIPTION
Eclipse is a multi-language software development environment
comprising an integrated development environment (IDE) and an
extensible plug-in system. It is written mostly in Java and can be
used to develop applications in Java and, by means of various
plug-ins, other programming languages including Ada, C, C++, COBOL,
Perl, PHP, Python, Ruby (including Ruby on Rails framework), Scala,
and Scheme. The IDE is often called Eclipse ADT for Ada, Eclipse CDT
for C/C++, Eclipse JDT for Java, and Eclipse PDT for PHP.
3. VULNERABILITY DESCRIPTION
Eclipse Help Contents are served as a web application via the built-in
Jetty Web Server plugin. Cross Site Scripting vulnerabilities were
found in /help/index.jsp and /help/advanced/content.jsp URLs. XSS on
/help/advanced/content.jsp url makes the browser hang
but even after clicking "Stop Executing" button, users can still get XSS.
4. VERSIONS AFFECTED
Eclipse IDE Version: 3.6.1 <=
Tested Editions(SDK, Java, J2EE)
In a situation where users' browser security settings are weak, the
localized XSS vector could enable attackers to perform a number of
black acts including cross site content access, smb shares
enumeration, remote code execution, malicious trojan downloading and
Apply the recent error-free nightly builds (ie.
According to the developer, "Chris Goldthorpe", the fix is in the
, it will also be in 3.6.2 (February 2011) and 3.7 (June 2011).
Eclipse Developers Team
This vulnerability was discovered by Aung Khant, http://yehg.net, YGN
Ethical Hacker Group, Myanmar.
10. DISCLOSURE TIME-LINE
2010-11-04 : vulnerability discovered
2010-11-05 : notified vendor
2010-11-08 : patch released and applied to svn
2010-11-16 : vulnerability disclosed
Original Advisory URL:
Eclipse Bug Tracker: https://bugs.eclipse.org/bugs/show_bug.cgi?id=329582
Previous XSS Flaws:
Cross Environment Hopping:
About Eclipse IDE:
YGN Ethical Hacker Group
Our Lab | http://yehg.net/lab
Our Directory | http://yehg.net/hwd
P5 -> P3 mass change
*** Bug 662929 has been marked as a duplicate of this bug. ***
CVE-2008-7271: CVSS v2 Base Score: 2.6 (low) (AV:N/AC:H/Au:N/C:N/I:P/A:N): Cross-Site Scripting (XSS) (CWE-79)
Multiple cross-site scripting (XSS) vulnerabilities in the Help
Contents web application (aka the Help Server) in Eclipse IDE,
possibly 3.3.2, allow remote attackers to inject arbitrary web script
or HTML via (1) the searchWord parameter to
help/advanced/searchView.jsp or (2) the workingSet parameter in an add
action to help/advanced/workingSetManager.jsp, a different issue than
None (candidate not yet proposed)
All products affected expired in the meantime.