Remote Code Execution in Eclipse Theia Markdown Preview Feature
CVE-2020-27224

9.6CRITICAL

Key Information:

Vendor

The Eclipse Foundation

Status
Eclipse Theia
Vendor
CVE Published:
24 February 2021

What is CVE-2020-27224?

A security vulnerability exists in the Markdown Preview component of Eclipse Theia versions up to 1.2.0, which can be exploited by an attacker to execute arbitrary code. This can lead to unauthorized access and control over the affected system. Developers and users of Eclipse Theia should be aware of this issue and consider applying the necessary updates to mitigate potential risks.

Affected Version(s)

Eclipse Theia <= 1.2.0

References

https://github.com/eclipse-theia/theia/issues/7954
x_refsource_CONFIRM
https://omespino.com/write-up-google-bug-bounty-xss-to-cl...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.6
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
The Cyber Security Vulnerability Database.