In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20260630 and ACTF based application miChecker versions up to 3.1.0), it has been identified that an XML External Entity (XXE) vulnerability exists.
If this vulnerability is exploited, a malicious third party could gain access to local resources or internal network resources via computer running applications that use Eclipse ACTF, including miChecker.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
Active
User action required
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 2
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Eclipse Accessibility_Tools_Framework
cpe:2.3:a:eclipse:accessibility_tools_framework:*:*:*:*:*:*:*:*
|
0.5.0
|
<= 1.6.0
|
|
Soumu Michecker
cpe:2.3:a:soumu:michecker:*:*:*:*:*:*:*:*
|
— |
3.2.0
|
References 4
https://eclipse.dev/actf/downloads/tools/miChecker/vulnerability.html
emo@eclipse.org
https://github.com/eclipse-actf/org.eclipse.actf
emo@eclipse.org
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/151
emo@eclipse.org
https://www.soumu.go.jp/info-accessibility-portal/webaccessibility/michecker/
emo@eclipse.org