CVE-2019-10248
Severity Score
8.1
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Eclipse Vorto versions prior to 0.11 resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by a MITM attack. Hence produced build artifacts of Vorto might be infected.
Eclipse Vorto en versiones anteriores a 0.11 resolvía los artefactos de construcción en Maven para proyecto Xtext sobre HTTP en lugar de HTTPS. Cualquiera de estos artefactos dependientes podría haber sido comprometidos maliciosamente por un ataque Man-in-the-Middle (MitM). Por lo tanto, los artefactos de construcción producidos en Vorto podrían infectarse.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2019-03-27 CVE Reserved
- 2019-04-22 CVE Published
- 2023-03-07 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-494: Download of Code Without Integrity Check
- CWE-669: Incorrect Resource Transfer Between Spheres
- CWE-829: Inclusion of Functionality from Untrusted Control Sphere
CAPEC
References (1)
| URL | Tag | Source |
|---|---|---|
| https://bugs.eclipse.org/bugs/show_bug.cgi?id=546622 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|