PT-2019-11657 · Eclipse · Eclipse Vorto

Alexander Edelmann · Publicado 2019-04-22 · Atualizado 2022-05-24 · CVE-2019-10248

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Eclipse Vorto versions prior to 0.11

Description: The issue allows for a Man-In-The-Middle (MITM) attack, where dependent artifacts could be maliciously compromised because Eclipse Vorto resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS. This could result in produced build artifacts of Vorto being infected.

Recommendations: For Eclipse Vorto versions prior to 0.11, update to version 0.11 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-494

CWE-829

CWE-669

Identificadores relacionados

CVE-2019-10248

GHSA-FG2Q-V428-2GPH

Produtos afetados

Eclipse Vorto

Referências · 5

• https://github.com/eclipse/vorto · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-10248 · Nota de Segurança
• https://bugs.eclipse.org/bugs/show_bug.cgi?id=546622 · Nota
• https://osv.dev/vulnerability/GHSA-fg2q-v428-2gph · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-10248 · Aviso do Fabricante