CVE-2019-9150

Mailvelope prior to 3.3.0 does not require user interaction to import public keys shown on web page

published July 9, 2019

CVSS
—
EPSS
1%
Percentile
71.7
In the wild
Unconfirmed
What it is

Mailvelope prior to 3.3.0 does not require user interaction to import public keys shown on web page. This functionality can be tricked to either hide a key import from the user or obscure which key was imported.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01379 · 71.7th percentile
Published
2019-07-09T20:49Z
EPSS history
Timeline
  • 09 JUL 20:49Z
    Mailvelope prior to 3.3.0 does not require user interaction to import public keys shown on web page
    cvelistv5