CVE-2020-27219: XSS
In all version of Eclipse Hawkbit prior to 0.3.0M7, the HTTP 404 (Not Found) JSON response body returned by the REST API may contain unsafe characters within the path attribute. Sending a POST request to a non existing resource will return the full path from the given URL unescaped to the client.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-27219?
CVE-2020-27219 has a moderate severity rating due to the potential for unsafe characters in the error responses.
How do I fix CVE-2020-27219?
To fix CVE-2020-27219, upgrade Eclipse Hawkbit to version 0.3.0M7 or later.
What kind of attack does CVE-2020-27219 allow?
CVE-2020-27219 allows an attacker to potentially retrieve unsafe or sensitive path information through unescaped JSON responses.
Which versions of Eclipse Hawkbit are affected by CVE-2020-27219?
CVE-2020-27219 affects all versions of Eclipse Hawkbit prior to 0.3.0M7.
Is there a workaround for CVE-2020-27219?
There is no official workaround for CVE-2020-27219, and updating to the fixed version is recommended.