What is GHSA-fg2q-v428-2gph?

GHSA-fg2q-v428-2gph is a security advisory published by GitHub Security Advisories with High severity. Eclipse Vorto resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS

Which CVE IDs does GHSA-fg2q-v428-2gph cover?

GHSA-fg2q-v428-2gph covers the following CVE IDs: CVE-2019-10248. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-fg2q-v428-2gph?

GHSA-fg2q-v428-2gph has a CVSS v3 base score of 8.1, published by GitHub Security Advisories.

Which products are affected by GHSA-fg2q-v428-2gph?

GHSA-fg2q-v428-2gph affects 1 product, including: maven/org.eclipse.vorto:org.eclipse.vorto.core:\u003c 0.11.0.

GHSA-fg2q-v428-2gphHighCVSS 8.1

Eclipse Vorto resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

February 2, 2023

🔗 CVE IDs covered (1)

CVE-2019-10248 →

📋 Description

Eclipse Vorto versions prior to 0.11 resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by a MITM attack. Hence produced build artifacts of Vorto might be infected.

🎯 Affected products1

maven/org.eclipse.vorto:org.eclipse.vorto.core:< 0.11.0

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2019-10248
https://bugs.eclipse.org/bugs/show_bug.cgi?id=546622
https://github.com/advisories/GHSA-fg2q-v428-2gph