Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2019-5448

Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network.

VectorNETWORK

PublishedJul 30, 2019, 21:15

Published Bysupport@hackerone.com

Base Score

Score8.1

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

yarn(npm)01.17.3N/A

References

https://github.com/ChALkeR/notes/blob/master/Yarn-vuln.md
https://hackerone.com/reports/640904
https://yarnpkg.com/blog/2019/07/12/recommended-security-update/

Weakness Type

CWE-319

CVSS Metrics

Base Score

8.1

Vector String

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Base SeverityHigh

Version

3.1

Attack Vector (AV)

NETWORK