CVE-2019-11770 Vulnerability Details

  /     /     /  

CVE-2019-11770 Metadata Quick Info

CVE Published: 14/06/2019 | CVE Updated: 04/08/2024 | CVE Year: 2019
Source: eclipse | Vendor: The Eclipse Foundation | Product: Eclipse Buildship
Status : PUBLISHED

---

CVE-2019-11770 Description

In Eclipse Buildship versions prior to 3.1.1, the build files indicate that this project is resolving dependencies over HTTP instead of HTTPS. Any of these artifacts could have been MITM to maliciously compromise them and infect the build artifacts that were produced. Additionally, if any of these JARs or other dependencies were compromised, any developers using these could continue to be infected past updating to fix this.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-829
CWE Name: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Source: The Eclipse Foundation

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).