Unrated severityNVD Advisory· Published Dec 11, 2023· Updated Aug 2, 2024

CVE-2023-6194

Description

In Eclipse Memory Analyzer versions 0.7 to 1.14.0, report definition XML files are not filtered to prohibit document type definition (DTD) references to external entities. This means that if a user chooses to use a malicious report definition XML file containing an external entity reference to generate a report then Eclipse Memory Analyzer may access external files or URLs defined via a DTD in the report definition.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Eclipse/Memory Analyzerllm-fuzzy
Range: >=0.7 <=1.14.0
Eclipse Foundation/Eclipse Memory Analyzer (tools.mat)v5
Range: 0.7

Patches

Vulnerability mechanics

References

bugs.eclipse.org/bugs/show_bug.cgimitre
gitlab.eclipse.org/security/cve-assignement/-/issues/15mitre
gitlab.eclipse.org/security/vulnerability-reports/-/issues/169mitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000