Arbitrary JavaScript Code Injection in Eclipse Theia Debug Console
CVE-2021-28161

6.1MEDIUM

Key Information:

Vendor
The Eclipse Foundation
Status
Eclipse Theia
Vendor
CVE Published:
12 March 2021

Summary

In Eclipse Theia versions up to and including 1.8.0, the debug console lacks proper HTML escaping, which may allow an attacker to inject and execute malicious JavaScript code. This vulnerability could be exploited by an attacker to perform unauthorized actions or access sensitive information, posing significant security risks to users and their environments.

Affected Version(s)

Eclipse Theia <= 1.8.0

References

https://github.com/eclipse-theia/theia/issues/8794
x_refsource_CONFIRM

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.