In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all     sorts of XXE attacks. The user just needs to open any evil project or update an open project with a     vulnerable file (for example for review a foreign repository or patch). (CVE-2023-4218)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1304-1 advisory.

  - In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all     sorts of XXE attacks. The user just needs to open any evil project or update an open project with a     vulnerable file (for example for review a foreign repository or patch). (CVE-2023-4218)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
262274	Linux Distros Unpatched Vulnerability : CVE-2023-4218	Nessus	Misc.	medium
193388	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : eclipse, maven-surefire, tycho (SUSE-SU-2024:1304-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2023-4218

medium

Tenable Plugins

medium

medium