kevinsawicki/http-request Missing certificate validation

中危 5.9CVE-2019-1010206 · GHSA-8mx3-gp3p-vgg7 · Published 23/07/2019 · updated 17/06/2026

要点

CVE-2019-1010206 是影响 com.github.kevinsawicki:http-request, http request (http request project) 的中危 (CVSS 5.9)漏洞。
未来 30 天内被利用的概率（EPSS）：0.57%，高于 47.4% 的漏洞。
暂无已修复版本：请关注参考资料中的厂商公告。

Package	Affected versions	Patched versions
com.github.kevinsawicki:http-request Maven	`≤ 6.0`	No fix yet
http request http_request_project	`= 6.0`	No fix yet

Description

OSS Http Request (kevinsawicki/http-request) is missing SSL/TLS certificate validation. The impact is: certificate spoofing. The component is: use this library when https communication. The attack vector is: certificate spoofing.

NVD description

OSS Http Request (Apache Cordova Plugin) 6 is affected by: Missing SSL certificate validation. The impact is: certificate spoofing. The component is: use this library when https communication. The attack vector is: certificate spoofing.

References

nvd.nist.gov/vuln/detail/CVE-2019-1010206 · ADVISORY
kevinsawicki/http-request · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free