Detections
Analytics

SCA: security update for org.eclipse.birt:org.eclipse.birt.report.viewer (GHSA-4grc-q4fj-45p8)

high Tenable Cloud Security Plugin ID 410189

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In Eclipse BIRT, starting from version 2.6.2, the default configuration allowed to retrieve a report from
 the same host using an absolute HTTP path for the report parameter (e.g.
 __report=http://xyz.com/report.rptdesign). If the host indicated in the __report parameter matched the
 HTTP Host header value, the report would be retrieved. However, the Host header can be tampered with on
 some configurations where no virtual hosts are put in place (e.g. in the default configuration of Apache
 Tomcat) or when the default host points to the BIRT server. This vulnerability was patched on Eclipse BIRT
 4.13. (CVE-2023-0100)

See Also

https://github.com/advisories/GHSA-4grc-q4fj-45p8

Plugin Details

Severity: High

ID: 410189

Version: Revision 1.19

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.86

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2023-0100

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 3/15/2023

Vulnerability Publication Date: 3/15/2023

Reference Information

CVE: CVE-2023-0100

cwe: CWE-20