CVE-2019-17633: CSRF
For Eclipse Che versions 6.16 to 7.3.0, with both authentication and TLS disabled, visiting a malicious web site could trigger the start of an arbitrary Che workspace. Che with no authentication and no TLS is not usually deployed on a public network but is often used for local installations (e.g. on personal laptops). In that case, even if the Che API is not exposed externally, some javascript running in the local browser is able to send requests to it.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-17633?
CVE-2019-17633 is a vulnerability found in Eclipse Che versions 6.16 to 7.3.0 with both authentication and TLS disabled.
How does the CVE-2019-17633 vulnerability affect Eclipse Che?
The CVE-2019-17633 vulnerability allows visiting a malicious website to trigger the start of an arbitrary Che workspace when authentication and TLS are disabled.
What is the severity of CVE-2019-17633?
CVE-2019-17633 has a severity rating of 8.8, which is classified as high.
Which software versions are affected by CVE-2019-17633?
Eclipse Che versions 6.16 to 7.3.0 are affected by CVE-2019-17633.
Is CVE-2019-17633 commonly found on public networks?
No, CVE-2019-17633 is not usually deployed on a public network but is often used for local installations.