PT-2019-11652 · Eclipse · Eclipse Hawkbit

Dominic Schabel · Publicado 2019-04-03 · Atualizado 2021-10-28 · CVE-2019-10240

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Eclipse hawkBit versions prior to 0.3.0M2

Description: The issue allows for the potential compromise of Maven build artifacts used by the Vaadin based UI due to the use of HTTP instead of HTTPS. This could lead to maliciously compromised artifacts, resulting in potentially infected build artifacts of hawkBit. A man-in-the-middle (MITM) attack could exploit this issue.

Recommendations: For Eclipse hawkBit versions prior to 0.3.0M2, update to version 0.3.0M2 or later to resolve the issue. As a temporary workaround, consider restricting the use of HTTP for resolving Maven build artifacts to minimize the risk of exploitation.

Exploit

Correção

Cleartext Transmission of Sensitive Information

Enumeração de Fraquezas

CWE-319

CWE-494

CWE-829

Identificadores relacionados

CVE-2019-10240

GHSA-JWQM-C9F2-2CQ3

Produtos afetados

Eclipse Hawkbit

Referências · 5

• 🔥 https://bugs.eclipse.org/bugs/show_bug.cgi?id=546053 · Exploit
• https://osv.dev/vulnerability/CVE-2019-10240 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-jwqm-c9f2-2cq3 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-10240 · Nota de Segurança
• https://github.com/advisories/GHSA-jwqm-c9f2-2cq3 · Nota