CVE-2010-4647 Multiple cross-site scripting (XSS) vulnerabilities in the Help Contents web application (aka the Help Server) in Eclipse IDE before 3.6.2 allow remote attackers to inject arbitrary web script or HTML...
MediumCVSS 4.3
EPSS 5.7%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple cross-site scripting (XSS) vulnerabilities in the Help Contents web application (aka the Help Server) in Eclipse IDE before 3.6.2 allow remote attackers to inject arbitrary web script or HTML via the query string to (1) help/index.jsp or (2) help/advanced/content.jsp.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| eclipse ide | <= 3.6.1 | No fix listed |
| eclipse ide | = 1.0 | No fix listed |
| eclipse ide | = 2.0 | No fix listed |
| eclipse ide | = 2.0.1 | No fix listed |
| eclipse ide | = 2.0.2 | No fix listed |
| eclipse ide | = 2.1 | No fix listed |
| eclipse ide | = 2.1.1 | No fix listed |
| eclipse ide | = 2.1.2 | No fix listed |
| eclipse ide | = 2.1.3 | No fix listed |
| eclipse ide | = 3.0 | No fix listed |
| eclipse ide | = 3.0.1 | No fix listed |
| eclipse ide | = 3.0.2 | No fix listed |
| eclipse ide | = 3.1 | No fix listed |
| eclipse ide | = 3.1.1 | No fix listed |
| eclipse ide | = 3.1.2 | No fix listed |
| eclipse ide | = 3.2 | No fix listed |
| eclipse ide | = 3.2.1 | No fix listed |
| eclipse ide | = 3.2.2 | No fix listed |
| eclipse ide | = 3.3 | No fix listed |
| eclipse ide | = 3.3.1 | No fix listed |
| eclipse ide | = 3.3.1.1 | No fix listed |
| eclipse ide | = 3.3.2 | No fix listed |
| eclipse ide | = 3.4 | No fix listed |
| eclipse ide | = 3.4.1 | No fix listed |
| eclipse ide | = 3.4.2 | No fix listed |
Show 14 more
| Product | Affected versions | Fixed in |
|---|---|---|
| eclipse ide | = 3.5 | No fix listed |
| eclipse ide | = 3.5.1 | No fix listed |
| eclipse ide | = 3.5.2 | No fix listed |
| eclipse ide | = 3.6-m1 | No fix listed |
| eclipse ide | = 3.6-m2 | No fix listed |
| eclipse ide | = 3.6-m3 | No fix listed |
| eclipse ide | = 3.6-m4 | No fix listed |
| eclipse ide | = 3.6-m5 | No fix listed |
| eclipse ide | = 3.6-m6 | No fix listed |
| eclipse ide | = 3.6-m7 | No fix listed |
| eclipse ide | = 3.6-rc1 | No fix listed |
| eclipse ide | = 3.6-rc2 | No fix listed |
| eclipse ide | = 3.6-rc3 | No fix listed |
| eclipse ide | = 3.6-rc4 | No fix listed |
References
- FEDORA-2010-18990 vendor-advisory
- FEDORA-2010-19006 vendor-advisory
- [oss-security] 20110106 Re: CVE Request: Eclipse IDE Version: 3.6.1 | Help Server Local Cross Site Scripting (XSS) exploit mailing-list
- [oss-security] 20110106 CVE Request: Eclipse IDE Version: 3.6.1 | Help Server Local Cross Site Scripting (XSS) exploit mailing-list
- MDVSA-2011:032 vendor-advisory
- RHSA-2011:0568 vendor-advisory
- yehg.net
- bugs.eclipse.org
- eclipseide-querystring-xss(64833) vdb-entry