CVE-2019-10753 json
Incorrect Resource Transfer Between Spheres in eclipse-wtp
published 2019-09-05 7 y ago modified 2026-07-08 4 mo ago also GHSA-gvxv-5fp2-358q , EUVD-2019-0669
- cvss
- 5.9
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 54%
- public exploits
- 0
- none known
Summary
In all versions prior to version 3.9.6 for eclipse-wtp, all versions prior to version 9.4.4 for eclipse-cdt, and all versions prior to version 3.0.1 for eclipse-groovy, Spotless was resolving dependencies over an insecure channel (http). If the build occurred over an insecure connection, a malicious user could have perform a Man-in-the-Middle attack during the build and alter the build artifacts that were produced. In case that any of these artifacts were compromised, any developers using these could be altered. **Note:** In order to validate that this artifact was not compromised, the maintainer would need to confirm that none of the artifacts published to the registry were not altered with. Until this happens, we can not guarantee that this artifact was not compromised even though the probability that this happened is low.
Patch / fix
- maven com.diffplug.spotless:spotless-eclipse-wtp 3.9.6
- maven com.diffplug.spotless:spotless-eclipse-cdt 9.4.4
- maven com.diffplug.spotless:spotless-eclipse-groovy 3.0.1
- diffplug eclipse-cdt 9.4.4
- diffplug eclipse-groovy 3.0.1
- diffplug eclipse-wtp 3.9.6
Exploit prediction
0.72% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 5.9 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
| GitHub | 3.0 | 5.9 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.diffplug.spotless:spotless-eclipse-wtp | <3.9.6 |
3.9.6 |
| maven | com.diffplug.spotless:spotless-eclipse-cdt | <9.4.4 |
9.4.4 |
| maven | com.diffplug.spotless:spotless-eclipse-groovy | <3.0.1 |
3.0.1 |
Affected products
- n/a Spotless
Classification
- Weakness
-
- CWE-669 Incorrect Resource Transfer Between Spheres
References
-
snyk.io
/vuln/SNYK-JAVA-COMDIFFPLUGSPOTLESS-460377
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2019-10753
advisory
-
github.com
/diffplug/spotless/issues/360
web
-
github.com
/diffplug/spotless
package
Sources
- CVE List CVE-2019-10753
- GitHub Advisory GHSA-gvxv-5fp2-358q
- NVD CVE-2019-10753
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.