Bugzilla – Bug 662929
VUL-0: eclipse: Eclipse IDE Version: 3.6.1 | Help Server Local Cross Site Scripting (XSS)
Last modified: 2011-01-11 13:10:19 UTC
There is a security bug in package 'eclipse'.
This information is from 'oss-security'.
This bug is public.
There is no coordinated release date (CRD) set.
More information can be found here:
CVE number: CVE-2010-4647
CVE description: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4647
CVSS v2 Base Score: 4.3 (moderate) (AV:N/AC:M/Au:N/C:N/I:P/A:N)
---------- Weitergeleitete Nachricht ----------
Betreff: [oss-security] CVE Request: Eclipse IDE Version: 3.6.1 | Help Server
Local Cross Site Scripting (XSS)
Datum: Donnerstag 06 Januar 2011
Von: YGN Ethical Hacker Group <firstname.lastname@example.org>
Eclipse IDE | Help Server Local Cross Site Scripting (XSS) Vulnerability
The Help Content web application of Eclipse IDE was vulnerable to
Cross Site Scripting (XSS) Vulnerability.
2. PRODUCT DESCRIPTION
Eclipse is a multi-language software development environment
comprising an integrated development environment (IDE) and an
extensible plug-in system. It is written mostly in Java and can be
used to develop applications in Java and, by means of various
plug-ins, other programming languages including Ada, C, C++, COBOL,
Perl, PHP, Python, Ruby (including Ruby on Rails framework), Scala,
and Scheme. The IDE is often called Eclipse ADT for Ada, Eclipse CDT
for C/C++, Eclipse JDT for Java, and Eclipse PDT for PHP.
3. VULNERABILITY DESCRIPTION
Eclipse Help Contents are served as a web application via the built-in
Jetty Web Server plugin. Cross Site Scripting vulnerabilities were
found in /help/index.jsp and /help/advanced/content.jsp URLs. XSS on
/help/advanced/content.jsp url makes the browser hang
but even after clicking "Stop Executing" button, users can still get XSS.
4. VERSIONS AFFECTED
Eclipse IDE Version: 3.6.1 <=
Tested Editions(SDK, Java, J2EE)
In a situation where users' browser security settings are weak, the
localized XSS vector could enable attackers to perform a number of
black acts including cross site content access, smb shares
enumeration, remote code execution, malicious trojan downloading and
Apply the recent error-free nightly builds (ie.
According to the developer, "Chris Goldthorpe", the fix is in the
, it will also be in 3.6.2 (February 2011) and 3.7 (June 2011).
Eclipse Developers Team
This vulnerability was discovered by Aung Khant, http://yehg.net, YGN
Ethical Hacker Group, Myanmar.
10. DISCLOSURE TIME-LINE
2010-11-04 : vulnerability discovered
2010-11-05 : notified vendor
2010-11-08 : patch released and applied to svn
2010-11-16 : vulnerability disclosed
Original Advisory URL:
Eclipse Bug Tracker: https://bugs.eclipse.org/bugs/show_bug.cgi?id=329582
Previous XSS Flaws:
Cross Environment Hopping:
About Eclipse IDE:
last updated: 2010-12-24
*** This bug has been marked as a duplicate of bug 654596 ***