Log in Start free

Vulnerability · Published Jul 8, 2022 · Assigned by eclipse

CVE-2021-41037

Critical 10.0

In plain English

A critical-severity security flaw in Eclipse Equinox p2 from The Eclipse Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).

Severity (CVSS 3.1)10.0Critical
Exploit odds (30 days)0.9%top 41.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In Eclipse p2, installable units are able to alter the Eclipse Platform installation and the local machine via touchpoints during installation. Those touchpoints can, for example, alter the command-line used to start the application, injecting things like agent or other settings that usually require particular attention in term of security. Although p2 has built-in strategies to ensure artifacts are signed and then to help establish trust, there is no such strategy for the metadata part that does configure such touchpoints. As a result, it's possible to install a unit that will run malicious code during installation without user receiving any warning about this installation step being risky when coming from untrusted source.

Affected products (as reported)

VendorProductVersions
The Eclipse Foundation Eclipse Equinox p2 1.0.0 – before 4.28

Weakness: CWE-829 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References