Vulnerability Details CVE-2021-28162
In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 39.5%
CVSS Severity
CVSS v3 Score 6.1
CVSS v2 Score 4.3
Products affected by CVE-2021-28162
-
cpe:2.3:a:eclipse:theia:-
-
cpe:2.3:a:eclipse:theia:0.0.1
-
cpe:2.3:a:eclipse:theia:0.1.0
-
cpe:2.3:a:eclipse:theia:0.1.1
-
cpe:2.3:a:eclipse:theia:0.10.0
-
cpe:2.3:a:eclipse:theia:0.11.0
-
cpe:2.3:a:eclipse:theia:0.12.0
-
cpe:2.3:a:eclipse:theia:0.13.0
-
cpe:2.3:a:eclipse:theia:0.14.0
-
cpe:2.3:a:eclipse:theia:0.15.0
-
cpe:2.3:a:eclipse:theia:0.16.0
-
cpe:2.3:a:eclipse:theia:0.2.0
-
cpe:2.3:a:eclipse:theia:0.2.1
-
cpe:2.3:a:eclipse:theia:0.2.2
-
cpe:2.3:a:eclipse:theia:0.2.3
-
cpe:2.3:a:eclipse:theia:0.2.4
-
cpe:2.3:a:eclipse:theia:0.3.0
-
cpe:2.3:a:eclipse:theia:0.3.1
-
cpe:2.3:a:eclipse:theia:0.3.10
-
cpe:2.3:a:eclipse:theia:0.3.11
-
cpe:2.3:a:eclipse:theia:0.3.12
-
cpe:2.3:a:eclipse:theia:0.3.13
-
cpe:2.3:a:eclipse:theia:0.3.14
-
cpe:2.3:a:eclipse:theia:0.3.15
-
cpe:2.3:a:eclipse:theia:0.3.16
-
cpe:2.3:a:eclipse:theia:0.3.17
-
cpe:2.3:a:eclipse:theia:0.3.18
-
cpe:2.3:a:eclipse:theia:0.3.19
-
cpe:2.3:a:eclipse:theia:0.3.2
-
cpe:2.3:a:eclipse:theia:0.3.3
-
cpe:2.3:a:eclipse:theia:0.3.4
-
cpe:2.3:a:eclipse:theia:0.3.6
-
cpe:2.3:a:eclipse:theia:0.3.7
-
cpe:2.3:a:eclipse:theia:0.3.8
-
cpe:2.3:a:eclipse:theia:0.3.9
-
cpe:2.3:a:eclipse:theia:0.4.0
-
cpe:2.3:a:eclipse:theia:0.5.0
-
cpe:2.3:a:eclipse:theia:0.6.0
-
cpe:2.3:a:eclipse:theia:0.6.1
-
cpe:2.3:a:eclipse:theia:0.7.0
-
cpe:2.3:a:eclipse:theia:0.7.1
-
cpe:2.3:a:eclipse:theia:0.7.2
-
cpe:2.3:a:eclipse:theia:0.8.0
-
cpe:2.3:a:eclipse:theia:0.9.0