High severity · published Apr 3, 2019
CVE-2019-10240
Eclipse hawkBit versions prior to 0.3.0M2 resolved Maven build artifacts for the Vaadin based UI over HTTP instead of HTTPS
8.1
CVSS
0.4%
EPSS
No
On KEV
Description
Eclipse hawkBit versions prior to 0.3.0M2 resolved Maven build artifacts for the Vaadin based UI over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by a MITM attack. Hence produced build artifacts of hawkBit might be infected.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HA
Hawkbit · Eclipse
through 0.2.5; 0.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-10240
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-10240
Exploit
https://bugs.eclipse.org/bugs/show_bug.cgi?id=546053
More from Hawkbit
6.1
CVE-2020-27219
In all version of Eclipse Hawkbit prior to 0.3.0M7, the HTTP 404 (Not Found) JSON response body returned by the REST API may contain unsafe characters within the path attribute
4.3
CVE-2026-16454
Privilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware Exfiltration