Eclipse Business Intelligence And Reporting Tools vulnerabilities

3 CVEs affecting Eclipse Business Intelligence And Reporting Tools, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-0100, published 2023-03-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-34427, published 2021-06-25. Critical severity, CVSS 9.8. EPSS: 58% chance of exploitation in the next 30 days. In Eclipse BIRT versions 4.8.0 and earlier, an attacker can use query parameters to create a JSP file which is accessible from remote (current BIRT viewer dir) to inject JSP code into the running…
CVE-2019-11776, published 2019-08-09. Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days. In Eclipse BIRT versions 1.0 to 4.7, the Report Viewer allows Reflected XSS in URL parameter. Attacker can execute the payload in victim's browser context.
CVE-2023-0100, published 2023-03-15. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. In Eclipse BIRT, starting from version 2.6.2, the default configuration allowed to retrieve a report from the same host using an absolute HTTP path for the report parameter (e.g.…