What is CVE-2019-17636?

CVE-2019-17636 is a high-severity vulnerability in Eclipse Theia, classified under Insufficient Verification of Data Authenticity. CVSS score: 8.1/10. Published 2020-03-10.

How severe is CVE-2019-17636?

High severity. CVSS v3 base score is 8.1 out of 10.

Vulnerability in Eclipse Theia

CVE-2019-17636

In Eclipse Theia versions 0.3.9 through 0.15.0, one of the default pre-packaged Theia extensions is "Mini-Browser", published as "@theia/mini-browser" on npmjs.com. This extension, for its own needs, exposes a HTTP endpoint that allows to read the content of files on the host's filesystem, given their path, without restrictions on the requester's origin. This design is vulnerable to being exploited remotely through a DNS rebinding attack or a drive-by download of a carefully crafted exploit.

EPSS: 0.006 (45.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N.

Affected products

Eclipse Theia
The Eclipse Foundation Theia — versions 0.3.9 to 0.15.0

Weakness classification (CWE)

CWE-345 — Insufficient Verification of Data Authenticity

References

emo@eclipse.org (x_refsource_CONFIRM, Exploit, Issue Tracking, Vendor Advisory)

Frequently asked questions

What is CVE-2019-17636?: CVE-2019-17636 is a high-severity vulnerability in Eclipse Theia, classified under Insufficient Verification of Data Authenticity. CVSS score: 8.1/10. Published 2020-03-10.
How severe is CVE-2019-17636?: High severity. CVSS v3 base score is 8.1 out of 10.