CVE-2019-10240

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-04-03 · updated 2026-06-17
Weakness: CWE-494

Description

Eclipse hawkBit versions prior to 0.3.0M2 resolved Maven build artifacts for the Vaadin based UI over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by a MITM attack. Hence produced build artifacts of hawkBit might be infected.

Affected products

Eclipse Foundation eclipse-hawkbit/hawkbit: through 0.2.5; 0.3.0-m1

References

https://bugs.eclipse.org/bugs/show_bug.cgi?id=546053
https://bugs.eclipse.org/bugs/show_bug.cgi?id=546053

Get alerted when CVE-2019-10240 or the next vulnerability affects your stack