Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXJjdngtcm12Zi1teGNo

Cross-site Scripting in Eclipse Hawkbit

In all version of Eclipse Hawkbit prior to 0.3.0M7, the HTTP 404 (Not Found) JSON response body returned by the REST API may contain unsafe characters within the path attribute. Sending a POST request to a non existing resource will return the full path from the given URL unescaped to the client.

Permalink: https://github.com/advisories/GHSA-rcvx-rmvf-mxch
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXJjdngtcm12Zi1teGNo
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 3 years ago
Updated: almost 2 years ago

CVSS Score: 6.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Percentage: 0.00075
EPSS Percentile: 0.33532

Identifiers: GHSA-rcvx-rmvf-mxch, CVE-2020-27219
References:

• https://nvd.nist.gov/vuln/detail/CVE-2020-27219
• https://github.com/eclipse/hawkbit/issues/1067
• https://github.com/eclipse/hawkbit/commit/94b7c12cde1b38eda5414bd88d6d068008cfb9f9
• https://bugs.eclipse.org/bugs/show_bug.cgi?id=570289
• https://github.com/advisories/GHSA-rcvx-rmvf-mxch

Repository: https://github.com/eclipse/hawkbit
Blast Radius: 1.0

Affected Packages