Eclipse Kura Multiple Security Vulnerabilities

Bugtraq ID:	107844
Class:	Input Validation Error
CVE:	CVE-2019-10244 CVE-2019-10243 CVE-2019-10242
Remote:	Yes
Local:	Yes
Published:	Apr 09 2019 12:00AM
Updated:	Apr 09 2019 12:00AM
Credit:	Matteo Maiero
Vulnerable:	Eclipse Kura 4.0 Eclipse Kura 3.2 Eclipse Kura 3.1 Eclipse Kura 3.0 Eclipse Kura 2.1 Eclipse Kura 1.4 Eclipse Kura 1.2 Eclipse Kura 0.7.1
Not Vulnerable:	Eclipse Kura 4.1

Eclipse Kura Multiple Security Vulnerabilities

Eclipse Kura is prone to the following vulnerabilities:

1. A directory traversal vulnerability
2. An information disclosure vulnerability
3. An XML External Entity injection information disclosure vulnerability

Attackers can exploit these issues to obtain sensitive information that may aid in further attacks.

Eclipse Kura through 4.0.0 are vulnerable.

Eclipse Kura Multiple Security Vulnerabilities

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Eclipse Kura Multiple Security Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Eclipse Kura Multiple Security Vulnerabilities

References:

• Bug 545833 (CVE-2019-10242) - Possible path injection attack in skinServlet (Eclipse)
  
• Bug 545834 (CVE-2019-10243) - Jetty version reported in Server Reply (Eclipse)
  
• Bug 545835 (CVE-2019-10244) - Possible XXE attacks to XML parsers (Eclipse)
  
• Implemented fixes for possible XXE attacks to XML parsers. #2368 (Github)
  
• Kura Homepage (Eclipse)
  
• Remove the Jetty version from Server reply. #2305 (Github)