CVE-2019-10240 : Eclipse hawkBit versions prior to 0.3.0M2 resolved Maven build artifacts for the Vaadin based UI over HTTP instead of HT

Eclipse hawkBit versions prior to 0.3.0M2 resolved Maven build artifacts for the Vaadin based UI over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by a MITM attack. Hence produced build artifacts of hawkBit might be infected.

Published 2019-04-03 18:29:18

Updated 2021-10-28 13:54:33

Source Eclipse Foundation

View at NVD, CVE.org

Vulnerability category: File inclusion

Exploit prediction scoring system (EPSS) score for CVE-2019-10240

EPSS FAQ

0.14%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 49 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-10240

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P	8.6	6.4	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
8.1	HIGH	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	2.2	5.9	NIST
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2019-10240

CWE-319 Cleartext Transmission of Sensitive Information

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Assigned by: nvd@nist.gov (Primary)

CWE-494 Download of Code Without Integrity Check

The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

Assigned by: emo@eclipse.org (Secondary)

CWE-829 Inclusion of Functionality from Untrusted Control Sphere

The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

Assigned by: emo@eclipse.org (Secondary)

Products affected by CVE-2019-10240

Eclipse » Hawkbit
Versions up to, including, (<=) 0.2.5
cpe:2.3:a:eclipse:hawkbit:*:*:*:*:*:*:*:*
Matching versions
Eclipse » Hawkbit » Version: 0.3.0 Update M1
cpe:2.3:a:eclipse:hawkbit:0.3.0:m1:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2019-10240

Exploit prediction scoring system (EPSS) score for CVE-2019-10240

CVSS scores for CVE-2019-10240

CWE ids for CVE-2019-10240

References for CVE-2019-10240

Products affected by CVE-2019-10240