Vulnerability · Published Jan 14, 2021 · Assigned by eclipse

CVE-2020-27219

Medium 6.1

In plain English

A medium-severity cross-site scripting in Eclipse Hawkbit from The Eclipse Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)6.1Medium

Exploit odds (30 days)0.8%top 42.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Public PoC

Official description

In all version of Eclipse Hawkbit prior to 0.3.0M7, the HTTP 404 (Not Found) JSON response body returned by the REST API may contain unsafe characters within the path attribute. Sending a POST request to a non existing resource will return the full path from the given URL unescaped to the client.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.eclipse.hawkbit:hawkbit-parent	0.3.0M7	GHSA-rcvx-rmvf-mxch

Affected products (as reported)

Vendor	Product	Versions
The Eclipse Foundation	Eclipse Hawkbit	All versions prior 0.3.0M7

Weakness: CWE-79

References

https://bugs.eclipse.org/bugs/show_bug.cgi?id=570289 x_refsource_CONFIRM
https://github.com/eclipse/hawkbit/issues/1067 x_refsource_CONFIRM