Cross-site scripting in Eclipse Hawkbit
Priority LOW 29CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
In all version of Eclipse Hawkbit prior to 0.3.0M7, the HTTP 404 (Not Found) JSON response body returned by the REST API may contain unsafe characters within the path attribute. Sending a POST request to a non existing resource will return the full path from the given URL unescaped to the client.
Why it matters now
EPSS 0.00835 57th percentileScored 2026-11-07
Fix Fixed org.eclipse.hawkbit:hawkbit-parent (Maven): 0.3.0M7
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Eclipse Foundation | Eclipse Hawkbit | All versions prior 0.3.0M7 | — | No fix listed | CNA |
| — | org.eclipse.hawkbit:hawkbit-parent (Maven) | before 0.3.0M7 | 0.3.0M7 | Patch available | GHSA-rcvx-rmvf-mxch |
- Eclipse Hawkbit VendorEclipse Foundation Affected All versions prior 0.3.0M7 Fixed in — No fix listed CNA
- org.eclipse.hawkbit:hawkbit-parent (Maven) Vendor— Affected before 0.3.0M7 Fixed in 0.3.0M7 Patch available GHSA-rcvx-rmvf-mxch
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:hawkbit:*:*:*:*:*:*:*:* | up to 0.2.5 | Vulnerable | Eclipse Foundation |
| cpe:2.3:a:eclipse:hawkbit:0.3.0:m1:*:*:*:*:*:* | 0.3.0 m1 | Vulnerable | Eclipse Foundation |
| cpe:2.3:a:eclipse:hawkbit:0.3.0:m2:*:*:*:*:*:* | 0.3.0 m2 | Vulnerable | Eclipse Foundation |
| cpe:2.3:a:eclipse:hawkbit:0.3.0:m3:*:*:*:*:*:* | 0.3.0 m3 | Vulnerable | Eclipse Foundation |
| cpe:2.3:a:eclipse:hawkbit:0.3.0:m4:*:*:*:*:*:* | 0.3.0 m4 | Vulnerable | Eclipse Foundation |
| cpe:2.3:a:eclipse:hawkbit:0.3.0:m5:*:*:*:*:*:* | 0.3.0 m5 | Vulnerable | Eclipse Foundation |
| cpe:2.3:a:eclipse:hawkbit:0.3.0:m6:*:*:*:*:*:* | 0.3.0 m6 | Vulnerable | Eclipse Foundation |
- cpe:2.3:a:eclipse:hawkbit:*:*:*:*:*:*:*:* Versions up to 0.2.5 Vulnerable ·Eclipse Foundation
- cpe:2.3:a:eclipse:hawkbit:0.3.0:m1:*:*:*:*:*:* Versions 0.3.0 m1 Vulnerable ·Eclipse Foundation
- cpe:2.3:a:eclipse:hawkbit:0.3.0:m2:*:*:*:*:*:* Versions 0.3.0 m2 Vulnerable ·Eclipse Foundation
- cpe:2.3:a:eclipse:hawkbit:0.3.0:m3:*:*:*:*:*:* Versions 0.3.0 m3 Vulnerable ·Eclipse Foundation
- cpe:2.3:a:eclipse:hawkbit:0.3.0:m4:*:*:*:*:*:* Versions 0.3.0 m4 Vulnerable ·Eclipse Foundation
- cpe:2.3:a:eclipse:hawkbit:0.3.0:m5:*:*:*:*:*:* Versions 0.3.0 m5 Vulnerable ·Eclipse Foundation
- cpe:2.3:a:eclipse:hawkbit:0.3.0:m6:*:*:*:*:*:* Versions 0.3.0 m6 Vulnerable ·Eclipse Foundation
Remediation
- Fix · GHSA-rcvx-rmvf-mxch org.eclipse.hawkbit:hawkbit-parent (Maven) Fixed in 0.3.0M7 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-27219
- 2026-10-03 Alias added: GHSA-rcvx-rmvf-mxch
References
More Eclipse Foundation Hawkbit vulnerabilities
- TI-2019-07555 Cleartext transmission of sensitive information in Eclipse hawkBit CVSS 3.1HIGH 8.1
- TI-2026-13749 Privilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware Exfiltration CVSS 3.1MEDIUM 4.3
Sources
- CVE-2020-27219 · CVE Program
- CVE-2020-27219 · NVD
- FIRST EPSS
- GHSA-rcvx-rmvf-mxch · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences