8.1high
CVE-2019-10102
JetBrains Ktor framework (created using the Kotlin IDE template) versions before 1.1.0 were resolving artifacts using an http connection du…
Published 7 y ago · modified 4 mo ago · JSON
CVSS
8.1
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.8%
percentile 57%
Public exploits
0
none known
Summary
JetBrains Ktor framework (created using the Kotlin IDE template) versions before 1.1.0 were resolving artifacts using an http connection during the build process, potentially allowing an MITM attack. This issue was fixed in Kotlin plugin version 1.3.30.
Exploit prediction (EPSS)
0.82% probability of exploitation in the next 30 days, higher than 57% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 8.1 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Classification
- Weakness
- CWE-319 Cleartext Transmission of Sensitive Information
References
- blog.jetbrains.com /blog/2019/06/19/jetbrains-security-bulletin-q1-2019/ · x_transferred
- security.netapp.com /advisory/ntap-20230818-0012/ · x_transferred
Sources
- CVE List: CVE-2019-10102
- NVD: CVE-2019-10102
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.