« Volver al listado

CVE-2019-10249

Estado: ModificadaAlta (8.1)—

All Xtext & Xtend versions prior to 2.18.0 were built using HTTP instead of HTTPS file transfer and thus the built artifacts may have been compromised.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Eclipse — XtendEclipse — Xtext

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-10249",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "emo@eclipse.org",
      "affectedData": [
        {
          "vendor": "The Eclipse Foundation",
          "product": "Eclipse Xtext",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "2.18.0",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-05-06T16:29:00.240",
  "references": [
    {
      "url": "https://bugs.eclipse.org/bugs/show_bug.cgi?id=546996",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "emo@eclipse.org"
    },
    {
      "url": "https://github.com/eclipse/xtext-xtend/issues/759",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "source": "emo@eclipse.org"
    },
    {
      "url": "https://bugs.eclipse.org/bugs/show_bug.cgi?id=546996",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/eclipse/xtext-xtend/issues/759",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "emo@eclipse.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-494"
        },
        {
          "lang": "en",
          "value": "CWE-829"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-116"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "All Xtext & Xtend versions prior to 2.18.0 were built using HTTP instead of HTTPS file transfer and thus the built artifacts may have been compromised."
    },
    {
      "lang": "es",
      "value": "Todas las versiones de Xtext y Xtend anteriores a la versión 2.18.0, fueron construidos usando HTTP en un lugar de la transferencia de archivos HTTPS y, por lo tanto, los equipos construidos pueden haber sido comprometidos."
    }
  ],
  "lastModified": "2026-06-17T02:10:34.650",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:eclipse:xtend:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "935976C9-C545-4C52-9822-E107685CD302",
              "versionEndExcluding": "2.18.0"
            },
            {
              "criteria": "cpe:2.3:a:eclipse:xtext:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "14D5BAA9-B585-45CA-A880-B26C90FF1B9E",
              "versionEndExcluding": "2.18.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "emo@eclipse.org"
}