CVE-2019-11770

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

In Eclipse Buildship versions prior to 3.1.1, the build files indicate that this project is resolving dependencies over HTTP instead of HTTPS. Any of these artifacts could have been MITM to maliciously compromise them and infect the build artifacts that were produced. Additionally, if any of these JARs or other dependencies were compromised, any developers using these could continue to be infected past updating to fix this.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-829 CWE-669

Affected software

Vendor	Product	Versions
The Eclipse Foundation	Eclipse Buildship	>= unspecified, < 3.1.1

References

https://bugs.eclipse.org/bugs/show_bug.cgi?id=547734Vendor Advisory
https://github.com/eclipse/buildship/issues/855Exploit, Issue Tracking, Third Party Advisory
https://bugs.eclipse.org/bugs/show_bug.cgi?id=547734Vendor Advisory
https://github.com/eclipse/buildship/issues/855Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Jun 14, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-117717.8AIX builds of Eclipse OpenJ9 before 0.15.0 contain unused RPATHs which may facilitate code injection and privilege elevation by local users.CVE-2019-117729.8In Eclipse OpenJ9 prior to 0.15, the String.getBytes(int, int, byte[], int) method does not verify that the provided byte array is non-null CVE-2019-117737.8Prior to 0.1, AIX builds of Eclipse OMR contain unused RPATHs which may facilitate code injection and privilege elevation by local users.CVE-2019-117747.4Prior to 0.1, all builds of Eclipse OMR contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop CVE-2019-117757.4All builds of Eclipse OpenJ9 prior to 0.15 contain a bug where the loop versioner may fail to privatize a value that is pulled out of the lo CVE-2019-117766.1In Eclipse BIRT versions 1.0 to 4.7, the Report Viewer allows Reflected XSS in URL parameter. Attacker can execute the payload in victim's b CVE-2019-117777.5In the Eclipse Paho Java client library version 1.2.0, when connecting to an MQTT server using TLS and setting a host name verifier, the res CVE-2019-117785.4If an MQTT v5 client connects to Eclipse Mosquitto versions 1.6.0 to 1.6.4 inclusive, sets a last will and testament, sets a will delay inte CVE-2019-117796.5In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of appro CVE-2019-11787.0An elevation of privilege vulnerability exists in the way that the ssdpsrv.dll handles objects in memory. An attacker who successfully explo CVE-2019-117808.1Improper access control in the computed fields system of the framework of Odoo Community 13.0 and Odoo Enterprise 13.0 allows remote authent CVE-2019-117818.8Improper input validation in portal component in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier, allows remote attacke