CVE-2019-10240 - Eclipse hawkBit versions prior to 0.3.0M2 resolved Maven build artifacts for the Vaadin based UI over HTTP instead of HTTPS

Back Back to CVE browser

HIGH

Eclipse hawkBit versions prior to 0.3.0M2 resolved Maven build artifacts for the Vaadin based UI over HTTP instead of HTTPS

Published Apr 3, 2019

8.1

HIGH

CVSS 3.1

EPSS 0.43%

Description

Eclipse hawkBit versions prior to 0.3.0M2 resolved Maven build artifacts for the Vaadin based UI over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by a MITM attack. Hence produced build artifacts of hawkBit might be infected.

Affected products

Vendor The Eclipse Foundation Product Eclipse hawkBit Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <0.3.0M2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

The Eclipse Foundation

Eclipse hawkBit

n/a

Version	Status	Constraints
unspecified	affected	<0.3.0M2

Remediation

No remediation recorded yet.

Weaknesses (3)

CWE-319

CWE-494

CWE-829

References (4)

https://bugs.eclipse.org/bugs/show_bug.cgi?id=546053
x_refsource_CONFIRMExploitIssue TrackingVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-0424
Advisory
https://github.com/advisories/GHSA-jwqm-c9f2-2cq3
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-10240

Link	Providers	Tags
https://bugs.eclipse.org/bugs/show_bug.cgi?id=546053		x_refsource_CONFIRMExploitIssue TrackingVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-0424		Advisory
https://github.com/advisories/GHSA-jwqm-c9f2-2cq3		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-10240