Cross-Site Scripting Vulnerability in Eclipse Theia by Eclipse Foundation
CVE-2021-28162

6.1MEDIUM

Key Information:

Vendor
The Eclipse Foundation
Status
Eclipse Theia
Vendor
CVE Published:
12 March 2021

Summary

In versions of Eclipse Theia up to and including 0.16.0, an issue exists in the notification messages where there is a lack of HTML escaping. This vulnerability can allow attackers to execute malicious Javascript code in a user's browser, potentially leading to unauthorized access and manipulation of web content.

Affected Version(s)

Eclipse Theia <= 0.16.0

References

https://github.com/eclipse-theia/theia/issues/7283
x_refsource_CONFIRM

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.