Published: 13/01/2011 Updated: 13/02/2023

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 440

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Multiple cross-site scripting (XSS) vulnerabilities in the Help Contents web application (aka the Help Server) in Eclipse IDE prior to 3.6.2 allow remote malicious users to inject arbitrary web script or HTML via the query string to (1) help/index.jsp or (2) help/advanced/content.jsp.

Vulnerable Product	Search on Vulmon	Subscribe to Product
eclipse eclipse ide 3.6
eclipse eclipse ide 3.0
eclipse eclipse ide 3.2
eclipse eclipse ide 2.1.2
eclipse eclipse ide 3.1
eclipse eclipse ide 3.3
eclipse eclipse ide 3.1.2
eclipse eclipse ide 3.4.1
eclipse eclipse ide 2.0
eclipse eclipse ide 2.0.1
eclipse eclipse ide 3.4.2
eclipse eclipse ide 3.3.1
eclipse eclipse ide 3.3.1.1
eclipse eclipse ide 3.5.1
eclipse eclipse ide 2.1.3
eclipse eclipse ide 3.5.2
eclipse eclipse ide 3.0.1
eclipse eclipse ide 2.1
eclipse eclipse ide 2.0.2
eclipse eclipse ide 1.0
eclipse eclipse ide 3.0.2
eclipse eclipse ide 3.2.2
eclipse eclipse ide 3.1.1
eclipse eclipse ide 3.3.2
eclipse eclipse ide 3.4
eclipse eclipse ide 2.1.1
eclipse eclipse ide
eclipse eclipse ide 3.2.1
eclipse eclipse ide 3.5

Debian Bug report logs - #611849 CVE-2010-4647/CVE-2008-7271: XSS in help browser application Package: eclipse-platform; Maintainer for eclipse-platform is Debian Orbital Alignment Team <pkg-java-maintainers@listsaliothdebianorg>; Source for eclipse-platform is src:eclipse (PTS, buildd, popcon) Reported by: Moritz Muehlen ...

source: wwwsecurityfocuscom/bid/44883/info Eclipse IDE Help component is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site Thi ...

source: wwwsecurityfocuscom/bid/44883/info Eclipse IDE Help component is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site This ...

CWE-79 https://bugs.eclipse.org/bugs/show_bug.cgi?id=329582 http://openwall.com/lists/oss-security/2011/01/06/16 http://openwall.com/lists/oss-security/2011/01/06/7 http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052532.html http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052554.html http://www.mandriva.com/security/advisories?name=MDVSA-2011:032 http://www.redhat.com/support/errata/RHSA-2011-0568.html https://exchange.xforce.ibmcloud.com/vulnerabilities/64833 http://yehg.net/lab/pr0js/advisories/eclipse/%5Beclipse_help_server%5D_cross_site_scripting https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=611849 https://nvd.nist.gov https://www.exploit-db.com/exploits/34999/

CVE-2010-4647

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect