In Eclipse Buildship versions prior to 3.1.1, the build files indicate that this project…
Priority LOW 38CWE-829Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-829.
Summary
In Eclipse Buildship versions prior to 3.1.1, the build files indicate that this project is resolving dependencies over HTTP instead of HTTPS. Any of these artifacts could have been MITM to maliciously compromise them and infect the build artifacts that were produced. Additionally, if any of these JARs or other dependencies were compromised, any developers using these could continue to be infected past updating to fix this.
Why it matters now
EPSS 0.01265 69th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Eclipse Buildship (The Eclipse Foundation): 3.1.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Eclipse Foundation | Eclipse Buildship | before 3.1.1 | 3.1.1 | Patch available | CNA |
- Eclipse Buildship VendorEclipse Foundation Affected before 3.1.1 Fixed in 3.1.1 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:buildship:*:*:*:*:*:*:*:* | before 3.1.1 | Vulnerable | Eclipse Foundation |
- cpe:2.3:a:eclipse:buildship:*:*:*:*:*:*:*:* Versions before 3.1.1 Vulnerable ·Eclipse Foundation
Remediation
- Fix · CNA Eclipse Buildship (The Eclipse Foundation) Fixed in 3.1.1
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2019-11770
- 2026-10-03 Alias added: GHSA-2qmx-rjgf-q7p7
References
Sources
- CVE-2019-11770 · CVE Program
- CVE-2019-11770 · NVD
- FIRST EPSS
- GHSA-2qmx-rjgf-q7p7 · GitHub Advisory Database · CC BY 4.0
- CVE-2019-11770 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences