Описание
Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network.
Ссылки
- ExploitThird Party Advisory
- Permissions RequiredThird Party Advisory
- Vendor Advisory
- ExploitThird Party Advisory
- Permissions RequiredThird Party Advisory
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 1.17.3 (исключая)
cpe:2.3:a:yarnpkg:yarn:*:*:*:*:*:*:*:*
EPSS
Процентиль: 52%
0.00668
Низкий
8.1 High
CVSS3
4.3 Medium
CVSS2
Дефекты
CWE-311
CWE-319
Связанные уязвимости
CVSS3: 8.1
ubuntu
больше 7 лет назад
Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network.
CVSS3: 8.1
debian
больше 7 лет назад
Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Da ...
CVSS3: 8.1
altlinux
около 7 лет назад
ALT-PU-2019-2451: package `yarn` update to version 1.17.3-alt1
EPSS
Процентиль: 52%
0.00668
Низкий
8.1 High
CVSS3
4.3 Medium
CVSS2
Дефекты
CWE-311
CWE-319