Description
Eclipse Vorto versions prior to 0.11 resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by a MITM attack. Hence produced build artifacts of Vorto might be infected.
Remediation
References
https://bugs.eclipse.org/bugs/show_bug.cgi?id=546622
Related Vulnerabilities
CVE-2021-32731 Vulnerability in maven package org.xwiki.platform:xwiki-platform-web
CVE-2020-7600 Vulnerability in npm package querymen
CVE-2017-11556 Vulnerability in maven package org.webjars.npm:node-sass
CVE-2022-41936 Vulnerability in maven package org.xwiki.platform:xwiki-platform-rest-server
CVE-2018-1308 Vulnerability in maven package org.apache.solr:solr-dataimporthandler