CVE-2019-10244 XML external entity in Eclipse Kura
Attackers can exploit improper XML parser initialization in Eclipse Kura to perform XXE attacks, potentially reading sensitive data or executing code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-10244?
CVE-2019-10244 is a high-severity vulnerability in The Eclipse Foundation Eclipse Kura, published on 9 Apr 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Eclipse Kura versions up to 4.0.0, the Web UI package and component services, the Artemis simple Mqtt component and the emulator position service (not part of the device distribution) could potentially be target of XXE attack due to an improper factory and parser initialisation.
Weakness: CWE-611
Which versions are affected by CVE-2019-10244?
It affects 1 product.
Products include Eclipse Kura.
How do I fix CVE-2019-10244?
No fix has been published for CVE-2019-10244 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-10244 being exploited?
There is no known exploitation of CVE-2019-10244 in the wild and no public exploit code.
Other vulnerabilities in The Eclipse Foundation Eclipse Kura
Sources
Also known as GHSA-xxp4-hw2v-2vcr.