CVE-2019-10240

CVE-2019-10240 affects Eclipse hawkBit versions prior to 0.3.0M2, stemming from its use of HTTP instead of HTTPS to resolve Maven build artifacts for its Vaadin-based UI. This oversight created a critical vulnerability where a Man-in-the-Middle (MITM) attack could compromise dependent artifacts, potentially infecting hawkBit's build outputs. Rated with a CVSS score of 8.1 (HIGH), the vulnerability has a network attack vector and high impact on confidentiality, integrity, and availability, despite requiring high attack complexity. There is no evidence of active exploitation, public exploit code, or significant community discussion, and it is not listed in CISA's KEV catalog.