1. Home
  2. CVE Database
  3. CVE-2021-34436
CRITICAL · 9.8

CVE-2021-34436

In Eclipse Theia 0.1.1 to 0.2.0, it is possible to exploit the default build to obtain remote code execution (and XXE) via the theia-xml-extension. This extension uses lsp4xml (recently renamed to Lem...

Vulnerability Description

In Eclipse Theia 0.1.1 to 0.2.0, it is possible to exploit the default build to obtain remote code execution (and XXE) via the theia-xml-extension. This extension uses lsp4xml (recently renamed to LemMinX) in order to provide language support for XML. This is installed by default.

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
EclipseTheia>= 0.1.1, <= 0.2.0

Related Weaknesses (CWE)

CWE-22CWE-611

References

FAQ

What is CVE-2021-34436?

CVE-2021-34436 is a vulnerability with a CVSS score of 9.8 (CRITICAL). In Eclipse Theia 0.1.1 to 0.2.0, it is possible to exploit the default build to obtain remote code execution (and XXE) via the theia-xml-extension. This extension uses lsp4xml (recently renamed to Lem...

How severe is CVE-2021-34436?

CVE-2021-34436 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2021-34436?

Check the references section above for vendor advisories and patch information. Affected products include: Eclipse Theia.