CVE-2024-0740 - Eclipse Target Management <= 4.5.500 Command Injection

Back Back to CVE browser

CRITICAL

Eclipse Target Management <= 4.5.500 Command Injection

Published Apr 26, 2024

9.8

CRITICAL

CVSS 3.1

EPSS 1.24%

Description

Eclipse Target Management: Terminal and Remote System Explorer (RSE) version <= 4.5.400 has a remote code execution vulnerability that does not require authentication.

The fixed version is included in Eclipse IDE 2024-03

Affected products

Vendor Eclipse Foundation Product Eclipse Target Management Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=4.5.500

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Eclipse Foundation

Eclipse Target Management

unaffected

Version	Status	Constraints
0	affected	<=4.5.500

Vendor Eclipse Product Eclipse Ide Default
n/a
- Version
  0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Eclipse

Eclipse Ide

n/a

Version	Status	Constraints
0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-77

CWE-78

OS Command Injection

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-16529
Advisory
https://git.eclipse.org/r/c/tm/org.eclipse.tm/+/202145
Patch
https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/171
ExploitIssue TrackingVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-16529		Advisory
https://git.eclipse.org/r/c/tm/org.eclipse.tm/+/202145		Patch
https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/171		ExploitIssue TrackingVendor Advisory