PT-2019-11657 · Eclipse · Eclipse Vorto

Alexander Edelmann · Published 2019-04-22 · Updated 2022-05-24 · CVE-2019-10248

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Eclipse Vorto versions prior to 0.11

Description: The issue allows for a Man-In-The-Middle (MITM) attack, where dependent artifacts could be maliciously compromised because Eclipse Vorto resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS. This could result in produced build artifacts of Vorto being infected.

Recommendations: For Eclipse Vorto versions prior to 0.11, update to version 0.11 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-494

CWE-829

CWE-669

Related Identifiers

CVE-2019-10248

GHSA-FG2Q-V428-2GPH

Affected Products

Eclipse Vorto

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2019-10248 · Security Note
• https://osv.dev/vulnerability/GHSA-fg2q-v428-2gph · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10248 · Vendor Advisory
• https://github.com/eclipse/vorto · Note
• https://bugs.eclipse.org/bugs/show_bug.cgi?id=546622 · Note