VULNERABILITY INTELLIGENCE

CVE-2019-11770

CVSS score8.1 HIGH

EPSS probability1.27%

CISA KEVNot currently listed

Published2019-06-14

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

In Eclipse Buildship versions prior to 3.1.1, the build files indicate that this project is resolving dependencies over HTTP instead of HTTPS. Any of these artifacts could have been MITM to maliciously compromise them and infect the build artifacts that were produced. Additionally, if any of these JARs or other dependencies were compromised, any developers using these could continue to be infected past updating to fix this.

Weakness classification

CWE-669: Incorrect Resource Transfer Between Spheres
CWE-829: Inclusion of Functionality from Untrusted Control Sphere

Primary references

emo@eclipse.org — Vendor Advisory
emo@eclipse.org — Exploit, Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Issue Tracking, Third Party Advisory