CVE-2019-9149

Mailvelope prior to 3.3.0 allows private key operations without user interaction via its client-API

published July 9, 2019

CVSS
—
EPSS
1%
Percentile
59.0
In the wild
Unconfirmed
What it is

Mailvelope prior to 3.3.0 allows private key operations without user interaction via its client-API. By modifying an URL parameter in Mailvelope, an attacker is able to sign (and encrypt) arbitrary messages with Mailvelope, assuming the private key password is cached. A second vulnerability allows an attacker to decrypt an arbitrary message when the GnuPG backend is used in Mailvelope.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00890 · 59.0th percentile
Published
2019-07-09T20:45Z
EPSS history
Timeline
  • 09 JUL 20:45Z
    Mailvelope prior to 3.3.0 allows private key operations without user interaction via its client-API
    cvelistv5