Eclipse Vorto resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS

published 2019-04-22 7 y ago modified 2026-06-17 4 mo ago also GHSA-fg2q-v428-2gph , EUVD-2022-3767

cvss: 8.1; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 37%
public exploits: 0; none known

Eclipse Vorto versions prior to 0.11 resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by a MITM attack. Hence produced build artifacts of Vorto might be infected.

Patch / fix

fixed in 2

maven org.eclipse.vorto:org.eclipse.vorto.core 0.11.0
The Eclipse Foundation Eclipse Vorto 0.11

Exploit prediction

0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.0	8.1	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	6.8	AV:N/AC:M/Au:N/C:P/I:P/A:P
GitHub	3.0	8.1	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
maven	org.eclipse.vorto:org.eclipse.vorto.core	<0.11.0	0.11.0

Affected products

The Eclipse Foundation Eclipse Vorto

Classification

Weakness

CWE-829 Inclusion of Functionality from Untrusted Control Sphere
CWE-494 Download of Code Without Integrity Check
CWE-669 Incorrect Resource Transfer Between Spheres

References

bugs.eclipse.org /bugs/show_bug.cgi?id=546622
web, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2019-10248
advisory
github.com /eclipse/vorto
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary