All Xtext & Xtend versions prior to 2.18.0 were built using HTTP instead of HTTPS file transfer and thus the built artifacts may have been…

Description

All Xtext & Xtend versions prior to 2.18.0 were built using HTTP instead of HTTPS file transfer and thus the built artifacts may have been compromised.

Scores

EPSS (exploitation in 30 days)

0.65% · top 49% of all CVEs (5 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.1.

Weakness

• CWE-829: Inclusion of Functionality from Untrusted Control Sphere (opens in a new tab)All about CWE-829 and its CVEs
• CWE-494: Download of Code Without Integrity Check (opens in a new tab)All about CWE-494 and its CVEs
• CWE-116 (opens in a new tab)All about CWE-116 and its CVEs

Affected products

• The Eclipse Foundation · Eclipse Xtext

  • affected unspecified – < 2.18.0

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• Mavenorg.eclipse.xtend:org.eclipse.xtend.coreGHSA-rfj2-4g26-7jw5 (opens in a new tab)
• Mavenorg.eclipse.xtext:org.eclipse.xtextGHSA-rfj2-4g26-7jw5 (opens in a new tab)

References (2)

• https://bugs.eclipse.org/bugs/show_bug.cgi?id=546996 (opens in a new tab)x_refsource_CONFIRMx_transferred
• https://github.com/eclipse/xtext-xtend/issues/759 (opens in a new tab)x_refsource_CONFIRMx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-rfj2-4g26-7jw5 (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2019-10249](https://trackcve.app/badge/CVE-2019-10249.svg)](https://trackcve.app/cve/CVE-2019-10249)

Record last updated 4 Aug 2024, 22:17 UTC.