CVE-2019-10240: High severity eclipse hawkbit vulnerability
Eclipse hawkBit versions prior to 0.3.0M2 resolved Maven build artifacts for the Vaadin based UI over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by a MITM attack. Hence produced build artifacts of hawkBit might be infected.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-10240?
CVE-2019-10240 has been rated as a medium severity vulnerability due to the potential for man-in-the-middle attacks.
How do I fix CVE-2019-10240?
To fix CVE-2019-10240, upgrade to Eclipse HawkBit version 0.3.0M2 or later to ensure secure downloads over HTTPS.
What is the impact of CVE-2019-10240?
The impact of CVE-2019-10240 is the risk of malicious compromise of build artifacts due to unprotected HTTP communication.
Which versions of Eclipse HawkBit are affected by CVE-2019-10240?
Eclipse HawkBit versions prior to 0.3.0M2 and certain versions up to 0.2.5 are affected by CVE-2019-10240.
What type of attack is CVE-2019-10240 vulnerable to?
CVE-2019-10240 is vulnerable to man-in-the-middle (MITM) attacks that can compromise dependent Maven build artifacts.