SB2021030202 - Missing authentication in Eclipse Platform

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2021030202

SB2021030202 - Missing authentication in Eclipse Platform

Published: March 2, 2021 Updated: March 17, 2021

Security Bulletin ID SB2021030202
Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Missing authentication for critical function (CVE-ID: CVE-2020-27225)

The vulnerability allows a remote attacker to perform unauthorized actions against the application.

The vulnerability exists due to missing authentication when processing Active help requests to the local help web server. A remote non-authenticated attacker can send active help commands to the associated Eclipse platform process or Eclipse Rich Client Platform process.

Successful exploitation of the vulnerability may allow an attacker to read and modify data within the application, create or overwrite files on the system and perform a denial of service attack.


Remediation

Install update from vendor's website.

References