CVE-2019-5448 | BDVDB-2026-119978 Detail

yarnyarn

Description#

Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-311 Missing Encryption of Sensitive Data (CWE-311)

References#

https://hackerone.com/reports/640904
https://github.com/ChALkeR/notes/blob/master/Yarn-vuln.md
https://yarnpkg.com/blog/2019/07/12/recommended-security-update/

Exploit#

No public exploit known

History#

Version 12019-07-30Record published in the CVE List.
Version 22024-08-04Most recent update recorded in the CVE List.