PT-2019-11658 · Eclipse · Xtend+1

Jl Leitschuh · Published 2019-05-06 · Updated 2022-05-24 · CVE-2019-10249

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Xtext & Xtend versions prior to 2.18.0

Description: The issue concerns the use of HTTP instead of HTTPS for file transfer during the build process of Xtext & Xtend, potentially compromising built artifacts.

Recommendations: For versions prior to 2.18.0, update to version 2.18.0 or later to resolve the issue.

Exploit

Fix

Improper Encoding or Escaping of Output

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-116

CWE-829

CWE-494

CWE-319

Related Identifiers

CVE-2019-10249

GHSA-RFJ2-4G26-7JW5

Affected Products

Xtend

X/Text

References · 6

• 🔥 https://github.com/eclipse/xtext-xtend/issues/759 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-10249 · Security Note
• https://osv.dev/vulnerability/GHSA-rfj2-4g26-7jw5 · Vendor Advisory
• https://bugs.eclipse.org/bugs/show_bug.cgi?id=546996 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10249 · Vendor Advisory
• https://github.com/eclipse/xtext-xtend/commit/169de2cecc50ed9bf81c3cdc496ad8a799bdf17b · Note