CVEvulnerability
CVE-2019-5448
8.1 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-07-30
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-311, CWE-319
Description
Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network.
Affected configurations
• yarnpkg yarn (< 1.17.3)
Related
References
- https://github.com/ChALkeR/notes/blob/master/Yarn-vuln.md Exploit, Third Party Advisory
- https://hackerone.com/reports/640904 Permissions Required, Third Party Advisory
- https://yarnpkg.com/blog/2019/07/12/recommended-security-update/ Vendor Advisory
- https://github.com/ChALkeR/notes/blob/master/Yarn-vuln.md Exploit, Third Party Advisory
- https://hackerone.com/reports/640904 Permissions Required, Third Party Advisory
- https://yarnpkg.com/blog/2019/07/12/recommended-security-update/ Vendor Advisory