HIGH✓ PATCH🇵🇱 Wersja polska

CVE-2019-10102

CVSS 8.1v3.0pub. 2019-07-03upd. 2024-11-21

JetBrains Ktor framework (created using the Kotlin IDE template) versions before 1.1.0 were resolving artifacts using an http connection during the build process, potentially allowing an MITM attack. This issue was fixed in Kotlin plugin version 1.3.30.

CVSS Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Jetbrains Kotlin

    APP
    Jetbrains
    < 1.3.30

  • Jetbrains Ktor

    APP
    Jetbrains
    < 1.1.0
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
CWE
References

Related vulnerabilities

CVE-2019-12736CRITICAL9.8PL ✓same product

JetBrains Ktor: command injection w obsłudze protokołu LDAP

CVE-2023-45612HIGH8.6same product

In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to X...

CVE-2022-48476HIGH7.5same product

In JetBrains Ktor before 2.3.0 path traversal in the `resolveResource` method was possible

CVE-2022-29930HIGH8.7same product

SHA1 implementation in JetBrains Ktor Native 2.0.0 was returning the same value. The issue was fixed in Ktor v...

CVE-2021-43203HIGH7.5same product

In JetBrains Ktor before 1.6.4, nonce verification during the OAuth2 authentication process is implemented imp...