GCVE - cpe:2.3:a:eclipse_foundation:adoptium

Approved changes feed: RSS · Atom

cpe:2.3:a:eclipse_foundation:adoptium_temurin:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Eclipse Foundation (`2c315c48-0111-5572-bbde-cc70cfafb2e9`)
Product	Adoptium Temurin (`c29e3a5d-0937-5d8c-bc8f-d9f7d572d8b5`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-93649`	vulnerable	2026-11-03 10:16:30.713399	Details available In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24), the post-download page /[locale]/download takes a download URL from the "link" query parameter and automatically navigates to it with a meta http-equiv="refresh". The URL is checked against a list of trusted prefixes using String.startsWith() on the raw string, while the browser applies RFC 3986 dot-segment normalisation before navigating, so a value such as https://github.com/adoptium/temurin/../../attacker/malware/releases/download/v1/jdk.exe passes the check but resolves to an attacker-controlled repository. A victim who follows a crafted adoptium.net link is shown the genuine "Thank you for downloading Eclipse Temurin" page while their browser downloads a binary of the attacker's choosing Published: 2026-10-15T13:28:42.590Z Updated: 2026-10-16T18:46:25.952Z Open on db.gcve.eu Reference links https://github.com/adoptium/adoptium.net/security/advisories/GHSA-f228-m952-5r6w#event-1046947 https://gitlab.eclipse.org/security/cve-assignment/-/work_items/313 https://github.com/adoptium/adoptium.net/commit/cbb53cf4a41f068a70902217473d7e2fe5d6c6ad	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.