CVE-2024-5165

6.5 · MEDIUM

Published May 23, 2024 eclipse CWE-79 EPSS 0.50% (41th pctl) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Overview

CVE-2024-5165 is a medium-severity vulnerability affecting eclipse ditto. It was published on May 23, 2024 and has a CVSS 3.1 base score of 6.5 (MEDIUM).

This vulnerability has a CVSS 3.1 base score of 6.5, rated MEDIUM. It can be exploited remotely over the network. Some level of privileges is required for exploitation.

Technical Description

In Eclipse Ditto versions 3.0.0 to 3.5.5, the user input of several input fields of the Eclipse Ditto Explorer User Interface https://eclipse.dev/ditto/user-interface.html was not properly neutralized and thus vulnerable to both Reflected and Stored XSS (Cross Site Scripting).

Several inputs were not persisted at the backend of Eclipse Ditto, but only in local browser storage to save settings of "environments" of the UI and e.g. the last performed "search queries", resulting in a "Reflected XSS" vulnerability.

However, several other inputs were persisted at the backend of Eclipse Ditto, leading to a "Stored XSS" vulnerability. Those mean that authenticated and authorized users at Eclipse Ditto can persist Things in Ditto which can - when being displayed by other users also being authorized to see those Things in the Eclipse Ditto UI - cause scripts to be executed in the browser of other users.

Remediation

Check the references section for vendor advisories and patches from eclipse. Update ditto to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

Vendor	Product	Versions	Status
eclipse	ditto	>= 3.0.0, < 3.5.6	Affected

References

Frequently Asked Questions

What is CVE-2024-5165?

CVE-2024-5165 is a medium-severity vulnerability affecting eclipse ditto. It was published on May 23, 2024 and has a CVSS 3.1 base score of 6.5 (MEDIUM).

How severe is CVE-2024-5165?

This vulnerability has a CVSS 3.1 base score of 6.5, rated MEDIUM. It can be exploited remotely over the network. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2024-5165?

How can CyberStrike help with CVE-2024-5165?

CyberStrike's AI-powered security agents can automatically detect CVE-2024-5165 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.

How CyberStrike Helps

Autonomous Discovery

AI agents map your attack surface to find vulnerabilities like this one.

Continuous Pentesting

Automated penetration testing that runs continuously, not just quarterly.

Code Review

AI-driven PR review catches vulnerable dependencies before they ship.

HackBrowser

Browser-based exploitation validates findings with real proof-of-concept.

Related MEDIUM CVEs from 2024

View all →

6.9

CVE-2023-3726

OCSInventory allow stored email template with special characters that lead to a Stored cross-site Sc

6.9

CVE-2023-51719