CVE-2020-27219 json
Cross-site Scripting in Eclipse Hawkbit
published 2021-01-14 5 y ago modified 2026-06-17 4 mo ago also GHSA-rcvx-rmvf-mxch , EUVD-2022-1169
- cvss
- 6.1
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 57%
- public exploits
- 0
- none known
Summary
In all version of Eclipse Hawkbit prior to 0.3.0M7, the HTTP 404 (Not Found) JSON response body returned by the REST API may contain unsafe characters within the path attribute. Sending a POST request to a non existing resource will return the full path from the given URL unescaped to the client.
Patch / fix
Exploit prediction
0.83% chance of exploitation in the next 30 days, higher than 57% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
| GitHub | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.eclipse.hawkbit:hawkbit-parent | <0.3.0M7 |
0.3.0M7 |
Affected products
- The Eclipse Foundation Eclipse Hawkbit
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/eclipse/hawkbit/commit/94b7c12cde1b38eda5414bd88d6d068008cfb9f9
web
-
bugs.eclipse.org
/bugs/show_bug.cgi?id=570289
web, vendor-advisory
-
github.com
/eclipse/hawkbit/issues/1067
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2020-27219
advisory
Sources
- CVE List CVE-2020-27219
- GitHub Advisory GHSA-rcvx-rmvf-mxch
- NVD CVE-2020-27219
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.