Vulnerability · Published Sep 13, 2021 · Assigned by eclipse
CVE-2021-41033
High 8.1
In plain English
A high-severity security flaw in Eclipse Equinox from The Eclipse Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).
Severity (CVSS NVD)8.1High
Exploit odds (30 days)1.1%top 33.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In all released versions of Eclipse Equinox, at least until version 4.21 (September 2021), installation can be vulnerable to man-in-the-middle attack if using p2 repos that are HTTP; that can then be exploited to serve incorrect p2 metadata and entirely alter the local installation, particularly by installing plug-ins that may then run malicious code.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| The Eclipse Foundation | Eclipse Equinox | see references |
Weakness: CWE-300
References
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=575688 x_refsource_CONFIRM