Read the docs
TI-2019-07555 Aliases CVE-2019-10240GHSA-jwqm-c9f2-2cq3

Cleartext transmission of sensitive information in Eclipse hawkBit

Priority LOW 36CWE-494Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Code execution, Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-494 and CWE-319.

Summary

Eclipse hawkBit versions prior to 0.3.0M2 resolved Maven build artifacts for the Vaadin based UI over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by a MITM attack. Hence produced build artifacts of hawkBit might be infected.

Why it matters now

EPSS 0.00435 38th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Eclipse hawkBit (The Eclipse Foundation): 0.3.0M2org.eclipse.hawkbit:hawkbit-autoconfigure (Maven): 0.3.0M2+9 more products

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse FoundationEclipse hawkBitbefore 0.3.0M20.3.0M2Patch availableCNA
—org.eclipse.hawkbit:hawkbit-autoconfigure (Maven)before 0.3.0M20.3.0M2Patch availableGHSA-jwqm-c9f2-2cq3
—org.eclipse.hawkbit:hawkbit-ui (Maven)before 0.3.0M20.3.0M2Patch availableGHSA-jwqm-c9f2-2cq3
—org.eclipse.hawkbit:hawkbit-parent (Maven)before 0.3.0M20.3.0M2Patch availableGHSA-jwqm-c9f2-2cq3
—org.eclipse.hawkbit:hawkbit-starters (Maven)before 0.3.0M20.3.0M2Patch availableGHSA-jwqm-c9f2-2cq3
—org.eclipse.hawkbit:hawkbit-boot-starter (Maven)before 0.3.0M20.3.0M2Patch availableGHSA-jwqm-c9f2-2cq3
—org.eclipse.hawkbit:hawkbit-update-server (Maven)before 0.3.0M20.3.0M2Patch availableGHSA-jwqm-c9f2-2cq3
—org.eclipse.hawkbit:hawkbit-boot-starter-mgmt-ui (Maven)before 0.3.0M20.3.0M2Patch availableGHSA-jwqm-c9f2-2cq3
—org.eclipse.hawkbit:hawkbit-boot-starter-mgmt-api (Maven)before 0.3.0M20.3.0M2Patch availableGHSA-jwqm-c9f2-2cq3
—org.eclipse.hawkbit:hawkbit-boot-starter-dmf-api (Maven)before 0.3.0M20.3.0M2Patch availableGHSA-jwqm-c9f2-2cq3
—org.eclipse.hawkbit:hawkbit-boot-starter-ddi-api (Maven)before 0.3.0M20.3.0M2Patch availableGHSA-jwqm-c9f2-2cq3
  • Eclipse hawkBit VendorEclipse Foundation Affected before 0.3.0M2 Fixed in 0.3.0M2 Patch available CNA
  • org.eclipse.hawkbit:hawkbit-autoconfigure (Maven) Vendor— Affected before 0.3.0M2 Fixed in 0.3.0M2 Patch available GHSA-jwqm-c9f2-2cq3
  • org.eclipse.hawkbit:hawkbit-ui (Maven) Vendor— Affected before 0.3.0M2 Fixed in 0.3.0M2 Patch available GHSA-jwqm-c9f2-2cq3
  • org.eclipse.hawkbit:hawkbit-parent (Maven) Vendor— Affected before 0.3.0M2 Fixed in 0.3.0M2 Patch available GHSA-jwqm-c9f2-2cq3
  • org.eclipse.hawkbit:hawkbit-starters (Maven) Vendor— Affected before 0.3.0M2 Fixed in 0.3.0M2 Patch available GHSA-jwqm-c9f2-2cq3
  • org.eclipse.hawkbit:hawkbit-boot-starter (Maven) Vendor— Affected before 0.3.0M2 Fixed in 0.3.0M2 Patch available GHSA-jwqm-c9f2-2cq3
  • org.eclipse.hawkbit:hawkbit-update-server (Maven) Vendor— Affected before 0.3.0M2 Fixed in 0.3.0M2 Patch available GHSA-jwqm-c9f2-2cq3
  • org.eclipse.hawkbit:hawkbit-boot-starter-mgmt-ui (Maven) Vendor— Affected before 0.3.0M2 Fixed in 0.3.0M2 Patch available GHSA-jwqm-c9f2-2cq3
  • org.eclipse.hawkbit:hawkbit-boot-starter-mgmt-api (Maven) Vendor— Affected before 0.3.0M2 Fixed in 0.3.0M2 Patch available GHSA-jwqm-c9f2-2cq3
  • org.eclipse.hawkbit:hawkbit-boot-starter-dmf-api (Maven) Vendor— Affected before 0.3.0M2 Fixed in 0.3.0M2 Patch available GHSA-jwqm-c9f2-2cq3
  • org.eclipse.hawkbit:hawkbit-boot-starter-ddi-api (Maven) Vendor— Affected before 0.3.0M2 Fixed in 0.3.0M2 Patch available GHSA-jwqm-c9f2-2cq3

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:hawkbit:*:*:*:*:*:*:*:*up to 0.2.5VulnerableEclipse Foundation
cpe:2.3:a:eclipse:hawkbit:0.3.0:m1:*:*:*:*:*:*0.3.0 m1VulnerableEclipse Foundation
  • cpe:2.3:a:eclipse:hawkbit:*:*:*:*:*:*:*:* Versions up to 0.2.5 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:hawkbit:0.3.0:m1:*:*:*:*:*:* Versions 0.3.0 m1 Vulnerable ·Eclipse Foundation

Remediation

  • Fix · CNA Eclipse hawkBit (The Eclipse Foundation) Fixed in 0.3.0M2
  • Fix · GHSA-jwqm-c9f2-2cq3 org.eclipse.hawkbit:hawkbit-autoconfigure (Maven) Fixed in 0.3.0M2 Advisory →
  • Fix · GHSA-jwqm-c9f2-2cq3 org.eclipse.hawkbit:hawkbit-ui (Maven) Fixed in 0.3.0M2 Advisory →
  • Fix · GHSA-jwqm-c9f2-2cq3 org.eclipse.hawkbit:hawkbit-parent (Maven) Fixed in 0.3.0M2 Advisory →
  • Fix · GHSA-jwqm-c9f2-2cq3 org.eclipse.hawkbit:hawkbit-starters (Maven) Fixed in 0.3.0M2 Advisory →
  • Fix · GHSA-jwqm-c9f2-2cq3 org.eclipse.hawkbit:hawkbit-boot-starter (Maven) Fixed in 0.3.0M2 Advisory →
  • Fix · GHSA-jwqm-c9f2-2cq3 org.eclipse.hawkbit:hawkbit-update-server (Maven) Fixed in 0.3.0M2 Advisory →
  • Fix · GHSA-jwqm-c9f2-2cq3 org.eclipse.hawkbit:hawkbit-boot-starter-mgmt-ui (Maven) Fixed in 0.3.0M2 Advisory →
  • Fix · GHSA-jwqm-c9f2-2cq3 org.eclipse.hawkbit:hawkbit-boot-starter-mgmt-api (Maven) Fixed in 0.3.0M2 Advisory →
  • Fix · GHSA-jwqm-c9f2-2cq3 org.eclipse.hawkbit:hawkbit-boot-starter-dmf-api (Maven) Fixed in 0.3.0M2 Advisory →
  • Fix · GHSA-jwqm-c9f2-2cq3 org.eclipse.hawkbit:hawkbit-boot-starter-ddi-api (Maven) Fixed in 0.3.0M2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-10240
  2. 2026-10-03 Alias added: GHSA-jwqm-c9f2-2cq3

References

Exploit 1

Advisory 2

  • TI-2020-16545 Cross-site scripting in Eclipse Hawkbit CVSS 3.1MEDIUM 6.1
  • TI-2026-13749 Privilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware Exfiltration CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences