CVE catalog

CVE-2019-17637

eclipse-wtp: CVE-2019-17637

Severity: High · CVSS 7.1CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Published: Jan 1, 2019, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.88% · Oct 25, 2026

In all versions of Eclipse Web Tools Platform through release 3.18 (2020-06), XML and DTD files referring to external entities could be exploited to send the contents of local files to a remote server when edited or validated, even when external entity resolution is disabled in the user preferences.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	eclipse-wtp	sid	`3.35-1`	fixed
Debian	eclipse-wtp	forky	`3.35-1`	fixed
Debian	eclipse-wtp	bookworm	`3.18-6`	fixed
Ubuntu	eclipse-wtp	16.04	`3.6.3-1`	vulnerable
Ubuntu	eclipse-wtp	18.04	`3.6.3-3`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	eclipse-wtp	source	sid	`3.18-1`	not yet assigned	Not reported	Not reported
Debian	eclipse-wtp	source	forky	`3.18-1`	not yet assigned	Not reported	Not reported
Debian	eclipse-wtp	source	bookworm	`3.18-1`	not yet assigned	Not reported	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libeclipse-jem-util-java]Fixed
Source package: [eclipse-wtp]
Details (2)
- 2.1.201+eclipse3.18-6 · all · bookworm
  Fixed · Fixed: 3.18-1
  dsa · eclipse-wtp · debian · bookworm; dsa · eclipse-wtp · debian · 12
- 2.1.201+eclipse3.18-6 · all · bookworm
  Fixed · Fixed: 3.18-1
  dsa · eclipse-wtp · debian · bookworm; dsa · eclipse-wtp · debian · 12
[libeclipse-wst-common-core-java]Fixed
Source package: [eclipse-wtp]
Details (2)
- 1.3.0+eclipse3.18-6 · all · bookworm
  Fixed · Fixed: 3.18-1
  dsa · eclipse-wtp · debian · bookworm; dsa · eclipse-wtp · debian · 12
- 1.3.0+eclipse3.18-6 · all · bookworm
  Fixed · Fixed: 3.18-1
  dsa · eclipse-wtp · debian · bookworm; dsa · eclipse-wtp · debian · 12
[libeclipse-wst-common-emf-java]Fixed
Source package: [eclipse-wtp]
Details (2)
- 1.2.600+eclipse3.18-6 · all · bookworm
  Fixed · Fixed: 3.18-1
  dsa · eclipse-wtp · debian · bookworm; dsa · eclipse-wtp · debian · 12
- 1.2.600+eclipse3.18-6 · all · bookworm
  Fixed · Fixed: 3.18-1
  dsa · eclipse-wtp · debian · bookworm; dsa · eclipse-wtp · debian · 12
[libeclipse-wst-common-emfworkbench-integration-java]Fixed
Source package: [eclipse-wtp]
Details (2)
- 1.2.101+eclipse3.18-6 · all · bookworm
  Fixed · Fixed: 3.18-1
  dsa · eclipse-wtp · debian · bookworm; dsa · eclipse-wtp · debian · 12
- 1.2.101+eclipse3.18-6 · all · bookworm
  Fixed · Fixed: 3.18-1
  dsa · eclipse-wtp · debian · bookworm; dsa · eclipse-wtp · debian · 12
[libeclipse-wst-common-environment-java]Fixed
Source package: [eclipse-wtp]
Details (2)
- 1.0.400+eclipse3.18-6 · all · bookworm
  Fixed · Fixed: 3.18-1
  dsa · eclipse-wtp · debian · bookworm; dsa · eclipse-wtp · debian · 12
- 1.0.400+eclipse3.18-6 · all · bookworm
  Fixed · Fixed: 3.18-1
  dsa · eclipse-wtp · debian · bookworm; dsa · eclipse-wtp · debian · 12
[libeclipse-wst-common-frameworks-java]Fixed
Source package: [eclipse-wtp]
Details (2)
- 1.2.201+eclipse3.18-6 · all · bookworm
  Fixed · Fixed: 3.18-1
  dsa · eclipse-wtp · debian · bookworm; dsa · eclipse-wtp · debian · 12
- 1.2.201+eclipse3.18-6 · all · bookworm
  Fixed · Fixed: 3.18-1
  dsa · eclipse-wtp · debian · bookworm; dsa · eclipse-wtp · debian · 12
[libeclipse-wst-common-frameworks-ui-java]Fixed
Source package: [eclipse-wtp]
Details (2)
- 1.2.400+eclipse3.18-6 · all · bookworm
  Fixed · Fixed: 3.18-1
  dsa · eclipse-wtp · debian · bookworm; dsa · eclipse-wtp · debian · 12
- 1.2.400+eclipse3.18-6 · all · bookworm
  Fixed · Fixed: 3.18-1
  dsa · eclipse-wtp · debian · bookworm; dsa · eclipse-wtp · debian · 12
[libeclipse-wst-common-project-facet-core-java]Fixed
Source package: [eclipse-wtp]
Details (2)
- 1.4.400+eclipse3.18-6 · all · bookworm
  Fixed · Fixed: 3.18-1
  dsa · eclipse-wtp · debian · bookworm; dsa · eclipse-wtp · debian · 12
- 1.4.400+eclipse3.18-6 · all · bookworm
  Fixed · Fixed: 3.18-1
  dsa · eclipse-wtp · debian · bookworm; dsa · eclipse-wtp · debian · 12
[libeclipse-wst-common-ui-java]Fixed
Source package: [eclipse-wtp]
Details (2)
- 1.1.700+eclipse3.18-6 · all · bookworm
  Fixed · Fixed: 3.18-1
  dsa · eclipse-wtp · debian · bookworm; dsa · eclipse-wtp · debian · 12
- 1.1.700+eclipse3.18-6 · all · bookworm
  Fixed · Fixed: 3.18-1
  dsa · eclipse-wtp · debian · bookworm; dsa · eclipse-wtp · debian · 12
[libeclipse-wst-common-uriresolver-java]Fixed
Source package: [eclipse-wtp]
Details (2)
- 1.2.300+eclipse3.18-6 · all · bookworm
  Fixed · Fixed: 3.18-1
  dsa · eclipse-wtp · debian · bookworm; dsa · eclipse-wtp · debian · 12
- 1.2.300+eclipse3.18-6 · all · bookworm
  Fixed · Fixed: 3.18-1
  dsa · eclipse-wtp · debian · bookworm; dsa · eclipse-wtp · debian · 12
[libeclipse-wst-sse-core-java]Fixed
Source package: [eclipse-wtp]
Details (2)
- 1.2.400+eclipse3.18-6 · all · bookworm
  Fixed · Fixed: 3.18-1
  dsa · eclipse-wtp · debian · bookworm; dsa · eclipse-wtp · debian · 12
- 1.2.400+eclipse3.18-6 · all · bookworm
  Fixed · Fixed: 3.18-1
  dsa · eclipse-wtp · debian · bookworm; dsa · eclipse-wtp · debian · 12
[libeclipse-wst-sse-ui-java]Fixed
Source package: [eclipse-wtp]
Details (2)
- 1.7.0+eclipse3.18-6 · all · bookworm
  Fixed · Fixed: 3.18-1
  dsa · eclipse-wtp · debian · bookworm; dsa · eclipse-wtp · debian · 12
- 1.7.0+eclipse3.18-6 · all · bookworm
  Fixed · Fixed: 3.18-1
  dsa · eclipse-wtp · debian · bookworm; dsa · eclipse-wtp · debian · 12
[libeclipse-wst-validation-java]Fixed
Source package: [eclipse-wtp]
Details (2)
- 1.2.800+eclipse3.18-6 · all · bookworm
  Fixed · Fixed: 3.18-1
  dsa · eclipse-wtp · debian · bookworm; dsa · eclipse-wtp · debian · 12
- 1.2.800+eclipse3.18-6 · all · bookworm
  Fixed · Fixed: 3.18-1
  dsa · eclipse-wtp · debian · bookworm; dsa · eclipse-wtp · debian · 12
[libeclipse-wst-validation-ui-java]Fixed
Source package: [eclipse-wtp]
Details (2)
- 1.2.600+eclipse3.18-6 · all · bookworm
  Fixed · Fixed: 3.18-1
  dsa · eclipse-wtp · debian · bookworm; dsa · eclipse-wtp · debian · 12
- 1.2.600+eclipse3.18-6 · all · bookworm
  Fixed · Fixed: 3.18-1
  dsa · eclipse-wtp · debian · bookworm; dsa · eclipse-wtp · debian · 12
[libeclipse-wst-xml-core-java]Fixed
Source package: [eclipse-wtp]
Details (2)
- 1.2.200+eclipse3.18-6 · all · bookworm
  Fixed · Fixed: 3.18-1
  dsa · eclipse-wtp · debian · bookworm; dsa · eclipse-wtp · debian · 12
- 1.2.200+eclipse3.18-6 · all · bookworm
  Fixed · Fixed: 3.18-1
  dsa · eclipse-wtp · debian · bookworm; dsa · eclipse-wtp · debian · 12
[libeclipse-wst-xml-ui-java]Fixed
Source package: [eclipse-wtp]
Details (2)
- 1.2.400+eclipse3.18-6 · all · bookworm
  Fixed · Fixed: 3.18-1
  dsa · eclipse-wtp · debian · bookworm; dsa · eclipse-wtp · debian · 12
- 1.2.400+eclipse3.18-6 · all · bookworm
  Fixed · Fixed: 3.18-1
  dsa · eclipse-wtp · debian · bookworm; dsa · eclipse-wtp · debian · 12
[libeclipse-wst-xsd-core-java]Fixed
Source package: [eclipse-wtp]
Details (2)
- 1.2.0+eclipse3.18-6 · all · bookworm
  Fixed · Fixed: 3.18-1
  dsa · eclipse-wtp · debian · bookworm; dsa · eclipse-wtp · debian · 12
- 1.2.0+eclipse3.18-6 · all · bookworm
  Fixed · Fixed: 3.18-1
  dsa · eclipse-wtp · debian · bookworm; dsa · eclipse-wtp · debian · 12

Observed: Oct 23, 2026, 5:41:50 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]