« Volver al listado

CVE-2020-27219

Estado: ModificadaMedia (6.1)—

In all version of Eclipse Hawkbit prior to 0.3.0M7, the HTTP 404 (Not Found) JSON response body returned by the REST API may contain unsafe characters within the path attribute. Sending a POST request to a non existing resource will return the full path from the given URL unescaped to the client.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Eclipse — Hawkbit

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-27219",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "emo@eclipse.org",
      "affectedData": [
        {
          "vendor": "The Eclipse Foundation",
          "product": "Eclipse Hawkbit",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior 0.3.0M7"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-01-14T23:15:12.977",
  "references": [
    {
      "url": "https://bugs.eclipse.org/bugs/show_bug.cgi?id=570289",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "emo@eclipse.org"
    },
    {
      "url": "https://github.com/eclipse/hawkbit/issues/1067",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "emo@eclipse.org"
    },
    {
      "url": "https://bugs.eclipse.org/bugs/show_bug.cgi?id=570289",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/eclipse/hawkbit/issues/1067",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "emo@eclipse.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In all version of Eclipse Hawkbit prior to 0.3.0M7, the HTTP 404 (Not Found) JSON response body returned by the REST API may contain unsafe characters within the path attribute. Sending a POST request to a non existing resource will return the full path from the given URL unescaped to the client."
    },
    {
      "lang": "es",
      "value": "En todas las versiones de Eclipse Hawkbit anteriores a 0.3.0M7, el cuerpo de respuesta JSON HTTP 404 (No Found) devuelto mediante la API REST puede contener caracteres no seguros dentro del atributo de ruta. El envío de una petición POST a un recurso no existente devolverá la ruta completa desde la URL dada sin escapar al cliente"
    }
  ],
  "lastModified": "2026-06-17T03:08:59.233",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:eclipse:hawkbit:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AECE2400-B719-4F2D-A67B-2C75E2686EBB",
              "versionEndIncluding": "0.2.5"
            },
            {
              "criteria": "cpe:2.3:a:eclipse:hawkbit:0.3.0:m1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "26D9B47F-213F-4994-ACDF-BE1964155B12"
            },
            {
              "criteria": "cpe:2.3:a:eclipse:hawkbit:0.3.0:m2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "57A5955E-333E-416A-A242-B291D29E04D3"
            },
            {
              "criteria": "cpe:2.3:a:eclipse:hawkbit:0.3.0:m3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "26D107A3-3E13-4CF5-B632-D2DEFCD6D165"
            },
            {
              "criteria": "cpe:2.3:a:eclipse:hawkbit:0.3.0:m4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BBCB05A1-1515-4BDD-B6EB-F792AA7E0304"
            },
            {
              "criteria": "cpe:2.3:a:eclipse:hawkbit:0.3.0:m5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "892D9F47-0B85-40D5-8C8C-045BD1313645"
            },
            {
              "criteria": "cpe:2.3:a:eclipse:hawkbit:0.3.0:m6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E591CBB2-B05B-4BFC-BE5B-3BDA78CD5B9D"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "emo@eclipse.org"
}