CVE-2023-6194 - CVE House

Back to Database

Status published Low CVE-2023-6194

In Eclipse Memory Analyzer versions 0.7 to 1.14.0, report definition...

2.8 CVSS

Vulnerability Description

In Eclipse Memory Analyzer versions 0.7 to 1.14.0, report definition XML files are not filtered to prohibit document type definition (DTD) references to external entities. This means that if a user chooses to use a malicious report definition XML file containing an external entity reference to generate a report then Eclipse Memory Analyzer may access external files or URLs defined via a DTD in the report definition.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-6194

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from Eclipse Foundation

View All →

In Jakarta Mail versions prior to 2.0.2 it is possible...

A vulnerability in the Eclipse Open VSX Registry’s automated publishing...

A denial-of-service vulnerability exists in the NetX IPv6 component functionality...

Potential out-of-bounds read in _ux_host_class_audio10_sam_parse_func()

Potential out-of-bounds read in _ux_host_class_audio_alternate_setting_locate()

Affected Vendor

Eclipse Foundation

View all reports →

Affected Software

Eclipse Memory Analyzer (tools.mat)

Vulnerable Versions:

0.7

Timeline

Official Publish: December 11th, 2023

Last Modified: August 2nd, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1005 Data from Local System

T1040 Network Sniffing

T1105 Ingress Tool Transfer

Command and Control

T1499 Endpoint Denial of Service