CVE-2021-34436
Published: 02 September 2021
Summary
CVE-2021-34436 is a critical-severity Path Traversal (CWE-22) vulnerability in Eclipse Theia. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 12.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-21091
Vulnerability details
In Eclipse Theia 0.1.1 to 0.2.0, it is possible to exploit the default build to obtain remote code execution (and XXE) via the theia-xml-extension. This extension uses lsp4xml (recently renamed to LemMinX) in order to provide language support for XML.…
more
This is installed by default.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing includes XML external entity payloads, detecting XXE vulnerabilities and enabling their mitigation.
Validates pathnames and filenames to prevent traversal outside intended directories.
Identifies XML external entity processing via monitoring of unusual file/network access or resource usage.