CVE-2024-5165: Eclipse Ditto User Interface vulnerable to XSS due to Improper Neutralization of Input
In Eclipse Ditto starting in version 3.0.0 and prior to versions 3.4.5 and 3.5.6, the user input of several input fields of the Eclipse Ditto Explorer User Interface https://eclipse.dev/ditto/user-interface.html was not properly neutralized and thus vulnerable to both Reflected and Stored XSS (Cross Site Scripting).
Several inputs were not persisted at the backend of Eclipse Ditto, but only in local browser storage to save settings of "environments" of the UI and e.g. the last performed "search queries", resulting in a "Reflected XSS" vulnerability.
However, several other inputs were persisted at the backend of Eclipse Ditto, leading to a "Stored XSS" vulnerability. Those mean that authenticated and authorized users at Eclipse Ditto can persist Things in Ditto which can - when being displayed by other users also being authorized to see those Things in the Eclipse Ditto UI - cause scripts to be executed in the browser of other users.
Other sources
In Eclipse Ditto versions 3.0.0 to 3.5.5, the user input of several input fields of the Eclipse Ditto Explorer User Interface https://eclipse.dev/ditto/user-interface.html was not properly neutralized and thus vulnerable to both Reflected and Stored XSS (Cross Site Scripting).
Several inputs were not persisted at the backend of Eclipse Ditto, but only in local browser storage to save settings of "environments" of the UI and e.g. the last performed "search queries", resulting in a "Reflected XSS" vulnerability.
However, several other inputs were persisted at the backend of Eclipse Ditto, leading to a "Stored XSS" vulnerability. Those mean that authenticated and authorized users at Eclipse Ditto can persist Things in Ditto which can - when being displayed by other users also being authorized to see those Things in the Eclipse Ditto UI - cause scripts to be executed in the browser of other users.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.eclipse.ditto:dittoto a version that resolves this vulnerability.Fixed in 3.5.6 - Upgrade
Upgrade
maven/org.eclipse.ditto:dittoto a version that resolves this vulnerability.Fixed in 3.4.5 - Upgrade
Upgrade
Eclipse Dittoto a version that resolves this vulnerability.Fixed in 3.4.5 - Upgrade
Upgrade
Eclipse Dittoto a version that resolves this vulnerability.Fixed in 3.5.6
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5165?
CVE-2024-5165 is classified as a moderate severity vulnerability due to improper neutralization of user input.
How do I fix CVE-2024-5165?
To fix CVE-2024-5165, upgrade to Eclipse Ditto version 3.4.5 or 3.5.6.
What versions of Eclipse Ditto are affected by CVE-2024-5165?
CVE-2024-5165 affects Eclipse Ditto versions from 3.0.0 to prior to 3.4.5 and 3.5.6.
What types of attacks does CVE-2024-5165 make the application vulnerable to?
CVE-2024-5165 makes the application vulnerable to both reflected and stored cross-site scripting (XSS) attacks.
Is there a workaround for CVE-2024-5165 until I can upgrade?
Currently, there are no documented workarounds for CVE-2024-5165, so upgrading is recommended.