Medium severity · published Jan 14, 2021
CVE-2020-27219
In all version of Eclipse Hawkbit prior to 0.3.0M7, the HTTP 404 (Not Found) JSON response body returned by the REST API may contain unsafe characters within the path attribute
6.1
CVSS
0.8%
EPSS
No
On KEV
Description
In all version of Eclipse Hawkbit prior to 0.3.0M7, the HTTP 404 (Not Found) JSON response body returned by the REST API may contain unsafe characters within the path attribute. Sending a POST request to a non existing resource will return the full path from the given URL unescaped to the client.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HA
Hawkbit · Eclipse
through 0.2.5; 0.3.0; 0.3.0; 0.3.0; 0.3.0; 0.3.0; +1 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-27219
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-27219
Vendor Advisory
https://bugs.eclipse.org/bugs/show_bug.cgi?id=570289
Third Party Advisory
https://github.com/eclipse/hawkbit/issues/1067
More from Hawkbit
8.1
CVE-2019-10240
Eclipse hawkBit versions prior to 0.3.0M2 resolved Maven build artifacts for the Vaadin based UI over HTTP instead of HTTPS
4.3
CVE-2026-16454
Privilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware Exfiltration