← CVE Intelligence

CVE-2021-34436

The Eclipse Foundation / Eclipse Theia PUBLISHED

Description (CNA)

In Eclipse Theia 0.1.1 to 0.2.0, it is possible to exploit the default build to obtain remote code execution (and XXE) via the theia-xml-extension. This extension uses lsp4xml (recently renamed to LemMinX) in order to provide language support for XML. This is installed by default.

Affected (CNA)

Vendor / productVersions
The Eclipse Foundation / Eclipse Theiaaffected 0.1.1; affected 0.1.2; affected 0.2.0-next.28bc2735; affected 0.2.0-next.41406d98; affected 0.2.0-next.a2958907

CWE

CWE-611, CWE-22

References

ADP enrichment

CVE

No English description supplied.