High severity7.8NVD Advisory· Published Mar 9, 2021· Updated Jun 17, 2026

CVE-2020-27225

Description

In versions 4.18 and earlier of the Eclipse Platform, the Help Subsystem does not authenticate active help requests to the local help web server, allowing an unauthenticated local attacker to issue active help commands to the associated Eclipse Platform process or Eclipse Rich Client Platform process.

Affected products

Eclipse/Platform3 versions
cpe:2.3:a:eclipse:platform:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:eclipse:platform:*:*:*:*:*:*:*:*range: <=4.18
- (no CPE)range: <=4.18
- (no CPE)range: unspecified
Eclipse/Rich Client Platformllm-create
Range: <=4.18
osv-coords2 versions
pkg:rpm/opensuse/eclipse&distro=openSUSE%20Leap%2015.2 pkg:rpm/opensuse/eclipse-bootstrap&distro=openSUSE%20Leap%2015.2
< 4.9.0-lp152.3.3.1+ 1 more
- (no CPE)range: < 4.9.0-lp152.3.3.1
- (no CPE)range: < 4.9.0-lp152.3.3.1

Patches

Vulnerability mechanics

References

bugs.eclipse.org/bugs/show_bug.cginvdExploitIssue TrackingPatchVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.507
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000