TI-2019-08018 Aliases CVE-2019-10753 GHSA-gvxv-5fp2-358q

In all versions prior to version 3.9.6 for eclipse-wtp, all versions prior to version…

LOW 28CWE-669Published 2019-09-05 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.

Summary

In all versions prior to version 3.9.6 for eclipse-wtp, all versions prior to version 9.4.4 for eclipse-cdt, and all versions prior to version 3.0.1 for eclipse-groovy, Spotless was resolving dependencies over an insecure channel (http). If the build occurred over an insecure connection, a malicious user could have perform a Man-in-the-Middle attack during the build and alter the build artifacts that were produced. In case that any of these artifacts were compromised, any developers using these could be altered. **Note:** In order to validate that this artifact was not compromised, the maintainer would need to confirm that none of the artifacts published to the registry were not altered with. Until this happens, we can not guarantee that this artifact was not compromised even though the probability that this happened is low.

Why it matters now

EPSS 0.00724 54th percentileScored 2026-11-07

Fix Fixed com.diffplug.spotless:spotless-eclipse-wtp (Maven): 3.9.6com.diffplug.spotless:spotless-eclipse-cdt (Maven): 9.4.4+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	Spotless	All versions prior to version 3.9.6 for eclipse-wtp, All versions prior to version 9.4.4 for eclipse-cdt, All versions prior to version 3.0.1 for eclipse-groovy.	—	No fix listed	CNA
—	com.diffplug.spotless:spotless-eclipse-wtp (Maven)	before 3.9.6	3.9.6	Patch available	GHSA-gvxv-5fp2-358q
—	com.diffplug.spotless:spotless-eclipse-cdt (Maven)	before 9.4.4	9.4.4	Patch available	GHSA-gvxv-5fp2-358q
—	com.diffplug.spotless:spotless-eclipse-groovy (Maven)	before 3.0.1	3.0.1	Patch available	GHSA-gvxv-5fp2-358q

Spotless Vendor— Affected All versions prior to version 3.9.6 for eclipse-wtp, All versions prior to version 9.4.4 for eclipse-cdt, All versions prior to version 3.0.1 for eclipse-groovy. Fixed in — No fix listed CNA
com.diffplug.spotless:spotless-eclipse-wtp (Maven) Vendor— Affected before 3.9.6 Fixed in 3.9.6 Patch available GHSA-gvxv-5fp2-358q
com.diffplug.spotless:spotless-eclipse-cdt (Maven) Vendor— Affected before 9.4.4 Fixed in 9.4.4 Patch available GHSA-gvxv-5fp2-358q
com.diffplug.spotless:spotless-eclipse-groovy (Maven) Vendor— Affected before 3.0.1 Fixed in 3.0.1 Patch available GHSA-gvxv-5fp2-358q

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:diffplug:eclipse-cdt::::::spotless::*	before 9.4.4	Vulnerable	Diffplug
cpe:2.3:a:diffplug:eclipse-groovy::::::spotless::*	before 3.0.1	Vulnerable	Diffplug
cpe:2.3:a:diffplug:eclipse-wtp::::::spotless::*	before 3.9.6	Vulnerable	Diffplug

cpe:2.3:a:diffplug:eclipse-cdt:*:*:*:*:*:spotless:*:* Versions before 9.4.4 Vulnerable ·Diffplug
cpe:2.3:a:diffplug:eclipse-groovy:*:*:*:*:*:spotless:*:* Versions before 3.0.1 Vulnerable ·Diffplug
cpe:2.3:a:diffplug:eclipse-wtp:*:*:*:*:*:spotless:*:* Versions before 3.9.6 Vulnerable ·Diffplug

Remediation

Fix · GHSA-gvxv-5fp2-358q com.diffplug.spotless:spotless-eclipse-wtp (Maven) Fixed in 3.9.6 Advisory →
Fix · GHSA-gvxv-5fp2-358q com.diffplug.spotless:spotless-eclipse-cdt (Maven) Fixed in 9.4.4 Advisory →
Fix · GHSA-gvxv-5fp2-358q com.diffplug.spotless:spotless-eclipse-groovy (Maven) Fixed in 3.0.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2019-10753
2026-10-03 Alias added: GHSA-gvxv-5fp2-358q

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2019-10753

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences