CVE-2020-27219

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-01-14 · updated 2026-06-17
Weakness: CWE-79

Description

In all version of Eclipse Hawkbit prior to 0.3.0M7, the HTTP 404 (Not Found) JSON response body returned by the REST API may contain unsafe characters within the path attribute. Sending a POST request to a non existing resource will return the full path from the given URL unescaped to the client.

Affected products

Eclipse Foundation eclipse-hawkbit/hawkbit: through 0.2.5; 0.3.0-m1, 0.3.0-m2, 0.3.0-m3, 0.3.0-m4, 0.3.0-m5, 0.3.0-m6

References

https://bugs.eclipse.org/bugs/show_bug.cgi?id=570289
https://github.com/eclipse/hawkbit/issues/1067
https://bugs.eclipse.org/bugs/show_bug.cgi?id=570289
https://github.com/eclipse/hawkbit/issues/1067

Get alerted when CVE-2020-27219 or the next vulnerability affects your stack