CVE-2019-17633
Last modified
CVE-2019-17633 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. For Eclipse Che versions 6.16 to 7.3.0, with both authentication and TLS disabled, visiting a malicious web site could trigger the start of an arbitrary Che workspace. Che with no authentication and no TLS is not usually deployed on a public network but is often used for local installations (e.g. EPSS estimates a 0.81% chance of exploitation in the next 30 days.
Description
For Eclipse Che versions 6.16 to 7.3.0, with both authentication and TLS disabled, visiting a malicious web site could trigger the start of an arbitrary Che workspace. Che with no authentication and no TLS is not usually deployed on a public network but is often used for local installations (e.g. on personal laptops). In that case, even if the Che API is not exposed externally, some javascript running in the local browser is able to send requests to it.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Eclipse | Che | >= 6.16.0, <= 7.3.0 |
References
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=551596Exploit, Issue Tracking, Vendor Advisory
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=551596Exploit, Issue Tracking, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-17633?
How severe is CVE-2019-17633?
How do I fix CVE-2019-17633?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-17627The Yale Bluetooth Key application for mobile devices allows…6.5
- CVE-2019-17629CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin…4.8
- CVE-2019-1763A vulnerability in the web-based management interface of Ses…7.5
- CVE-2019-17630CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin…4.8
- CVE-2019-17631From Eclipse OpenJ9 0.15 to 0.16, access to diagnostic opera…9.1
- CVE-2019-17632In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022…6.1
- CVE-2019-17634Eclipse Memory Analyzer version 1.9.1 and earlier is subject…9
- CVE-2019-17635Eclipse Memory Analyzer version 1.9.1 and earlier is subject…7.8
- CVE-2019-17636In Eclipse Theia versions 0.3.9 through 0.15.0, one of the d…8.1
- CVE-2019-17637In all versions of Eclipse Web Tools Platform through releas…7.1
- CVE-2019-17638In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200…9.4
- CVE-2019-17639In Eclipse OpenJ9 prior to version 0.21 on Power platforms, …5.3
Are you affected by CVE-2019-17633?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST