CVE-2019-17636

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-17636
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-17636.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-17636
Aliases
Published
2020-03-10T15:15:16.073Z
Modified
2026-07-08T19:02:37.085413Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
Summary
[none]
Details

In Eclipse Theia versions 0.3.9 through 0.15.0, one of the default pre-packaged Theia extensions is "Mini-Browser", published as "@theia/mini-browser" on npmjs.com. This extension, for its own needs, exposes a HTTP endpoint that allows to read the content of files on the host's filesystem, given their path, without restrictions on the requester's origin. This design is vulnerable to being exploited remotely through a DNS rebinding attack or a drive-by download of a carefully crafted exploit.

References

Affected packages

Git / github.com/eclipse-theia/theia

Affected ranges

Type
GIT
Repo
https://github.com/eclipse-theia/theia
Events
Introduced
7caa4c877661849f4e460055a2ca1695a2593b23
Last affected
e88b7f3c265025a4d97ebb178d164f84bdb11fab
Database specific 
{
    "cpe": "cpe:2.3:a:eclipse:theia:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "0.3.9"
        },
        {
            "last_affected": "0.15.0"
        }
    ]
}

Affected versions

v0.*
v0.10.0
v0.11.0
v0.12.0
v0.13.0
v0.14.0
v0.15.0
v0.3.10
v0.3.11
v0.3.12
v0.3.13
v0.3.14
v0.3.15
v0.3.16
v0.3.17
v0.3.18
v0.3.19
v0.3.9
v0.4.0
v0.5.0
v0.6.0
v0.7.0
v0.8.0
v0.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-17636.json"