{"cve":"CVE-2019-11770","nvd":{"published":"2019-06-14T14:29:00.530","modified":"2026-06-17T02:13:36.500","status":"Modified","description":"In Eclipse Buildship versions prior to 3.1.1, the build files indicate that this project is resolving dependencies over HTTP instead of HTTPS. Any of these artifacts could have been MITM to maliciously compromise them and infect the build artifacts that were produced. Additionally, if any of these JARs or other dependencies were compromised, any developers using these could continue to be infected past updating to fix this.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.1},"cwes":["CWE-669","CWE-829"],"references":["https://bugs.eclipse.org/bugs/show_bug.cgi?id=547734","https://github.com/eclipse/buildship/issues/855","https://bugs.eclipse.org/bugs/show_bug.cgi?id=547734","https://github.com/eclipse/buildship/issues/855"],"products":["eclipse:buildship"],"source":"nvd","synced_at":"2026-10-19T20:57:00.690689396+00:00"},"epss":{"cve":"CVE-2019-11770","score":0.01269,"percentile":0.69807,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}