CVE-2019-11777

mediumpriority · track · 30EPSS 0.008 · 56 %ileDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.80% (56th) EPSS

CVSS 5 · medium

Is it mine?

16 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · cert_bund · nvd

EPSS · scored 2026-10-26

In the Eclipse Paho Java client library version 1.2.0, when connecting to an MQTT server using TLS and setting a host name verifier, the result of that verification is not checked. This could allow one MQTT server to impersonate another and provide the client library with incorrect information.

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–7.5

v2.05mediumAV:N/AC:L/Au:N/C:P/I:N/A:Nprimary · NVD / NIST USexploitability 10 · impact 2.9

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 3.6

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · OSV

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-346USprimaryCWE-755USprimaryCWE-346USCWE-755US

affected products (16)

Products and version ranges known to be affected.

HCL BigFixall versionscert_bundDEcpe:/a:hcltech:bigfix:-
IBM App Connect Enterprise 10.1.0.0-10.1.0.5all versionscert_bundDEcpe:/a:ibm:app_connect_enterprise:10.1.0.5
IBM App Connect Enterprise 12.0.1.0-12.0.12.16all versionscert_bundDEcpe:/a:ibm:app_connect_enterprise:12.0.12.16
IBM App Connect Enterprise 13.0.1.0-13.0.4.1all versionscert_bundDEcpe:/a:ibm:app_connect_enterprise:v13__fix_pack_release_13.0.4.1
IBM MQall versionscert_bundDEcpe:/a:ibm:mq:-
IBM MQ Operatorall versionscert_bundDEcpe:/a:ibm:mq:operator
IBM Security Verify Access 10.0.Xall versionscert_bundDEcpe:/a:ibm:security_verify_access:10.0.x
IBM Spectrum Protectall versionscert_bundDEcpe:/a:ibm:spectrum_protect:-
IBM Spectrum Scaleall versionscert_bundDEcpe:/a:ibm:spectrum_scale:-
HCL Commerce< 9.0.1.20cert_bundDE
HCL Commerce< 9.1.12cert_bundDE
IBM Spectrum Protect≤ Plus <10.1.13cert_bundDE
IBM WebSphere Application Server≤ Liberty <22.0.0.8cert_bundDE
The Eclipse Foundation Eclipse Paho≤ 1.2.0enisa_euvdEU
eclipse paho java client= 1.2.0nvdUScpe:2.3:a:eclipse:paho_java_client:*:*:*:*:*:*:*:*
Maven org.eclipse.paho:org.eclipse.paho.client.mqttv3< 1.2.1osvUSpkg:maven/org.eclipse.paho/org.eclipse.paho.client.mqttv3

advisories (3)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2022-0617IBM WebSphere Application Server: Mehrere SchwachstellenDeutsch2022-07-07csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in IBM WebSphere Application Server ausnutzen, um Sicherheitsvorkehrungen zu umgehen und Informationen falsch darzustellen.
WID-SEC-W-2025-2057IBM App Connect Enterprise: Schwachstelle ermöglicht Darstellen falscher InformationenDeutsch2025-09-15csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in IBM App Connect Enterprise ausnutzen, um falsche Informationen darzustellen.
GHSA-63qc-p2x4-9fgfImproper Handling of Exceptional Conditions and Origin Validation Error in Eclipse Paho Java client library2019-09-17ghsa · osvUS
In the Eclipse Paho Java client library version 1.2.0, when connecting to an MQTT server using TLS and setting a host name verifier, the result of that verification is not checked. This could allow one MQTT server to impersonate another and provide the client library with incorrect information.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund nvd osv NVD CVE.org MITRE

published 2019-09-11modified 2026-06-17

related (1,624)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2025-34291US	high8.8OT critical	92.8% (100th)	KEV	2025-12-05
Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_…
CVE-2024-29748US	high7.8OT critical	0.68% (52nd)	KEV	2024-04-05
there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interacti…
CVE-2022-22265US	high7.8OT critical	0.39% (33rd)	KEV	2022-01-10
An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary memory write and code execution.
CVE-2021-38003US	high8.8OT critical	38.6% (99th)	KEV	2021-11-23
Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2020-7247US	critical9.8OT critical	99.0% (100th)	KEV	2020-01-29
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP sessio…

+1619 more

references (10)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan