What’s Vulnerable › Vulnerabilities

CVE-2019-10249

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-05-06 · updated 2026-06-17
• Weakness: CWE-494

Description

All Xtext & Xtend versions prior to 2.18.0 were built using HTTP instead of HTTPS file transfer and thus the built artifacts may have been compromised.

Affected products

• eclipse Xtend: before 2.18.0 — fixed in 2.18.0
• eclipse Xtext: before 2.18.0 — fixed in 2.18.0

How to fix

Upgrade to a fixed version: eclipse Xtend 2.18.0; eclipse Xtext 2.18.0. Check the vendor advisory for mitigations.

References

• https://bugs.eclipse.org/bugs/show_bug.cgi?id=546996
• https://github.com/eclipse/xtext-xtend/issues/759
• https://bugs.eclipse.org/bugs/show_bug.cgi?id=546996
• https://github.com/eclipse/xtext-xtend/issues/759

Get alerted when CVE-2019-10249 or the next vulnerability affects your stack