Eclipse Ditto User Interface vulnerable to XSS due to Improper Neutralization of Input
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
In Eclipse Ditto versions 3.0.0 to 3.5.5, the user input of several input fields of the Eclipse Ditto Explorer User Interface https://eclipse.dev/ditto/user-interface.html was not properly neutralized and thus vulnerable to both Reflected and Stored XSS (Cross Site Scripting). Several inputs were not persisted at the backend of Eclipse Ditto, but only in local browser storage to save settings of "environments" of the UI and e.g. the last performed "search queries", resulting in a "Reflected XSS" vulnerability. However, several other inputs were persisted at the backend of Eclipse Ditto, leading to a "Stored XSS" vulnerability. Those mean that authenticated and authorized users at Eclipse Ditto can persist Things in Ditto which can - when being displayed by other users also being authorized to see those Things in the Eclipse Ditto UI - cause scripts to be executed in the browser of other users.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Eclipse Foundation | Eclipse Ditto | before 3.4.6; 3.5.0 to before 3.5.6 | 3.4.6, 3.5.6 | Patch available | CNA |
| — | org.eclipse.ditto:ditto (Maven) | 3.0.0 to before 3.4.5 | 3.4.5 | Patch available | GHSA-hjfc-6jxr-j2rx |
| — | org.eclipse.ditto:ditto (Maven) | 3.5.0 to before 3.5.6 | 3.5.6 | Patch available | GHSA-hjfc-6jxr-j2rx |
- Eclipse Ditto VendorEclipse Foundation Affected before 3.4.6; 3.5.0 to before 3.5.6 Fixed in 3.4.6, 3.5.6 Patch available CNA
- org.eclipse.ditto:ditto (Maven) Vendor— Affected 3.0.0 to before 3.4.5 Fixed in 3.4.5 Patch available GHSA-hjfc-6jxr-j2rx
- org.eclipse.ditto:ditto (Maven) Vendor— Affected 3.5.0 to before 3.5.6 Fixed in 3.5.6 Patch available GHSA-hjfc-6jxr-j2rx
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:ditto:*:*:*:*:*:*:*:* | 3.0.0 to before 3.5.6 | Vulnerable | Eclipse Foundation |
- cpe:2.3:a:eclipse:ditto:*:*:*:*:*:*:*:* Versions 3.0.0 to before 3.5.6 Vulnerable ·Eclipse Foundation
Remediation
- Fix · CNA Eclipse Ditto (Eclipse Foundation) Fixed in 3.4.6, 3.5.6
- Fix · GHSA-hjfc-6jxr-j2rx org.eclipse.ditto:ditto (Maven) Fixed in 3.4.5 Advisory →
- Fix · GHSA-hjfc-6jxr-j2rx org.eclipse.ditto:ditto (Maven) Fixed in 3.5.6 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-5165
- 2026-10-03 Alias added: GHSA-hjfc-6jxr-j2rx
References
Exploit 7
- https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/211
- https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/210
- https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/209
- https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/207
- https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/204
- https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/202
- https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/201
Advisory 2
Other 7
- https://github.com/eclipse-ditto/ditto/commit/20399a0ab9ef219c7833c24cf8140ddfb298788d
- https://github.com/eclipse-ditto/ditto/commit/8fe1b3b9e0e2c333856dc166c8c3c7d2027c856d
- https://github.com/eclipse-ditto/ditto/commit/9d1bac36ca7be94516635ef71eedfea6df1e77f4
- https://github.com/eclipse-ditto/ditto/commit/cce2e961db08b5d591ef34920c61a0f7e7d810e4
- https://eclipse.dev/ditto/release_notes_345.html
- https://eclipse.dev/ditto/release_notes_356.html
- https://github.com/eclipse-ditto/ditto
Sources
- CVE-2024-5165 · CVE Program
- CVE-2024-5165 · NVD
- FIRST EPSS
- GHSA-hjfc-6jxr-j2rx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences