Eclipse Vorto resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS

HIGH 8.1CVE-2019-10248 · GHSA-fg2q-v428-2gph · Published 22/04/2019 · updated 17/06/2026

In short

CVE-2019-10248 is a HIGH (CVSS 8.1) vulnerability affecting org.eclipse.vorto:org.eclipse.vorto.core, vorto (eclipse).
Chance of exploitation in the next 30 days (EPSS): 0.43%, higher than 37.7% of all vulnerabilities.
Fix: update to 0.11.0, 0.11 or later.

Package	Affected versions	Patched versions
org.eclipse.vorto:org.eclipse.vorto.core Maven	`< 0.11.0`	`0.11.0`
vorto eclipse	`< 0.11`	`0.11`

Description

Eclipse Vorto versions prior to 0.11 resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by a MITM attack. Hence produced build artifacts of Vorto might be infected.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2019-10248 · ADVISORY
bugs.eclipse.org/bugs/show_bug.cgi · WEB
eclipse/vorto · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free