CVE-2019-5448CWE-311

Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over…

published July 30, 2019

CVSS
—
EPSS
1%
Percentile
51.3
In the wild
Unconfirmed
What it is

Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00668 · 51.3th percentile
Weakness
CWE-311 · Missing Encryption of Sensitive Data
Published
2019-07-30T20:15Z
EPSS history
Timeline
  • 30 JUL 20:15Z
    Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over…
    cvelistv5