description: Eclipse Vorto versions prior to 0.11 resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by a MITM attack. Hence produced build artifacts of Vorto might be infected.
problem types: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
affected:
{
product: Eclipse Vorto
vendor: The Eclipse Foundation
versions:
lessThan: 0.11, status: affected, version: unspecified, versionType: custom
}