CVE-2019-17637

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

In all versions of Eclipse Web Tools Platform through release 3.18 (2020-06), XML and DTD files referring to external entities could be exploited to send the contents of local files to a remote server when edited or validated, even when external entity resolution is disabled in the user preferences.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
The Eclipse Foundation	Eclipse Web Tools Platform	1.0 to 3.18

References

https://bugs.eclipse.org/bugs/show_bug.cgi?id=458571Exploit, Issue Tracking, Patch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2020/10/msg00016.htmlMailing List, Third Party Advisory
https://bugs.eclipse.org/bugs/show_bug.cgi?id=458571Exploit, Issue Tracking, Patch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2020/10/msg00016.htmlMailing List, Third Party Advisory

Timeline

Published: Jul 15, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-176389.4In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce CVE-2019-176395.3In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method with a length longer than the length of the CVE-2019-17648.8A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could all CVE-2019-176409.8In Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0.milestone1, 4.0.0.milestone2, 4.0.0.milestone3, 4.0.0.milestone4, 4.0.0.milestone5, 4.0.0.Beta1, CVE-2019-176428.8An issue was discovered in Centreon before 18.10.8, 19.10.1, and 19.04.2. It allows CSRF with resultant remote command execution via shell m CVE-2019-176437.5An issue was discovered in Centreon before 2.8-30,18.10-8, 19.04-5, and 19.10-2. It provides sensitive information via an unauthenticated di CVE-2019-176447.5An issue was discovered in Centreon before 2.8-30, 18.10-8, 19.04-5, and 19.10-2.. It provides sensitive information via an unauthenticated CVE-2019-176457.5An issue was discovered in Centreon before 2.8.31, 18.10.9, 19.04.6, and 19.10.3. It provides sensitive information via an unauthenticated d CVE-2019-176467.5An issue was discovered in Centreon before 18.10.8, 19.04.5, and 19.10.2. It provides sensitive information via an unauthenticated direct re CVE-2019-176479.8An issue was discovered in Centreon before 2.8.30, 18.10.8, 19.04.5, and 19.10.2. SQL Injection exists via the include/monitoring/status/Hos CVE-2019-17656.5A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could all CVE-2019-176507.8An Improper Neutralization of Special Elements used in a Command vulnerability in one of FortiClient for Mac OS root processes, may allow a