CVE-2019-19251

The Last.fm desktop app (Last.fm Scrobbler) through 2.1.39 on macOS makes HTTP requests that include an API key without the use of SSL/TLS

published December 10, 2019

CVSS
—
EPSS
1%
Percentile
50.7
In the wild
Unconfirmed
What it is

The Last.fm desktop app (Last.fm Scrobbler) through 2.1.39 on macOS makes HTTP requests that include an API key without the use of SSL/TLS. Although there is an Enable SSL option, it is disabled by default, and cleartext requests are made as soon as the app starts.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00654 · 50.7th percentile
Published
2019-12-10T14:26Z
EPSS history
Timeline
  • 10 DEC 14:26Z
    The Last.fm desktop app (Last.fm Scrobbler) through 2.1.39 on macOS makes HTTP requests that include an API key without the use of SSL/TLS
    cvelistv5