Description
Eclipse Vorto versions prior to 0.11 resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by a MITM attack. Hence produced build artifacts of Vorto might be infected.
Remediation
References
https://bugs.eclipse.org/bugs/show_bug.cgi?id=546622
Related Vulnerabilities
CVE-2019-15532 Vulnerability in npm package cyberchef
CVE-2021-40525 Vulnerability in maven package org.apache.james:james-server
CVE-2022-36907 Vulnerability in maven package org.jenkins-ci.plugins:openshift-deployer
CVE-2019-10277 Vulnerability in maven package hudson.plugins:starteam
CVE-2022-22138 Vulnerability in npm package fast-string-search