Published: 13/01/2011 Updated: 19/07/2011

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 440

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Multiple cross-site scripting (XSS) vulnerabilities in the Help Contents web application (aka the Help Server) in Eclipse IDE, possibly 3.3.2, allow remote malicious users to inject arbitrary web script or HTML via (1) the searchWord parameter to help/advanced/searchView.jsp or (2) the workingSet parameter in an add action to help/advanced/workingSetManager.jsp, a different issue than CVE-2010-4647.

Vulnerable Product	Search on Vulmon	Subscribe to Product
eclipse eclipse ide
eclipse eclipse ide 3.3.2

Debian Bug report logs - #611849 CVE-2010-4647/CVE-2008-7271: XSS in help browser application Package: eclipse-platform; Maintainer for eclipse-platform is Debian Orbital Alignment Team <pkg-java-maintainers@listsaliothdebianorg>; Source for eclipse-platform is src:eclipse (PTS, buildd, popcon) Reported by: Moritz Muehlen ...

source: wwwsecurityfocuscom/bid/45921/info Eclipse IDE is prone to multiple cross-site-scripting vulnerabilities because it fails to properly sanitize user-supplied input An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site This may let the att ...

source: wwwsecurityfocuscom/bid/45921/info Eclipse IDE is prone to multiple cross-site-scripting vulnerabilities because it fails to properly sanitize user-supplied input An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site This may let the a ...

CWE-79 https://bugs.eclipse.org/bugs/show_bug.cgi?id=223539 http://r00tin.blogspot.com/2008/04/eclipse-local-web-server-exploitation.html https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=611849 https://nvd.nist.gov https://www.exploit-db.com/exploits/35242/

CVE-2008-7271

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect