CVE-2019-10249
06.05.2019, 16:29
All Xtext & Xtend versions prior to 2.18.0 were built using HTTP instead of HTTPS file transfer and thus the built artifacts may have been compromised.Enginsight
| Vendor | Product | Version |
|---|---|---|
| eclipse | xtend | 𝑥 < 2.18.0 |
| eclipse | xtext | 𝑥 < 2.18.0 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-494 - Download of Code Without Integrity CheckThe product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.
- CWE-116 - Improper Encoding or Escaping of OutputThe software prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.