Unauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure in Eclipse Mnestix Browser server actions for configured Infrastructures

Summary

In Eclipse Mnestix Browser versions 1.6.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to exfiltrate the MNESTIX_BACKEND_API_KEY for all configured Infrastructures.

Remediation

1. Inventory every Eclipse Foundation Eclipse Mnestix deployment, including staging.
2. Upgrade Eclipse Foundation Eclipse Mnestix to 2.3.0.
3. Confirm the running version after the upgrade.

References

• Referencehttps://gitlab.eclipse.org/security/cve-assignment/-/work_items/302
• Referencehttps://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/773