What is CVE-2019-1010260?

CVE-2019-1010260 is a high-severity vulnerability in Ktlint, classified under Cleartext Transmission of Sensitive Information. CVSS score: 8.1/10. Published 2019-04-02.

How severe is CVE-2019-1010260?

High severity. CVSS v3 base score is 8.1 out of 10.

Vulnerability in Ktlint

CVE-2019-1010260

Using ktlint to download and execute custom rulesets can result in arbitrary code execution as the served jars can be compromised by a MITM. This attack is exploitable via Man in the Middle of the HTTP connection to the artifact servers. This vulnerability appears to have been fixed in 0.30.0 and later; after commit 5e547b287d6c260d328a2cb658dbe6b7a7ff2261.

EPSS: 0.015 (71.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Ktlint — versions 0.29.0 and earlier [fixed: 0.30.0 and later - after commit 5e547b287d6c260d328a2cb658dbe6b7a7ff2261]
Ktlint_project Ktlint

Weakness classification (CWE)

CWE-319 — Cleartext Transmission of Sensitive Information

References

josh@bress.net (Exploit, Patch, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2019-1010260?: CVE-2019-1010260 is a high-severity vulnerability in Ktlint, classified under Cleartext Transmission of Sensitive Information. CVSS score: 8.1/10. Published 2019-04-02.
How severe is CVE-2019-1010260?: High severity. CVSS v3 base score is 8.1 out of 10.