GHSA-wqfc-cr59-h64p
Suggest an improvement- Source
- https://github.com/advisories/GHSA-wqfc-cr59-h64p
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/07/GHSA-wqfc-cr59-h64p/GHSA-wqfc-cr59-h64p.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/GHSA-wqfc-cr59-h64p
- Aliases
- Published
- 2019-07-31T04:22:15Z
- Modified
- 2023-11-01T04:50:59.931411Z
- Severity
-
- 8.1 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Missing Encryption of Sensitive Data in yarn
- Details
-
Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network.
- Database specific
{ "github_reviewed": true, "nvd_published_at": "2019-07-30T21:15:00Z", "cwe_ids": [ "CWE-311", "CWE-319" ], "github_reviewed_at": "2019-07-31T03:41:57Z", "severity": "HIGH" }- References
Affected packages
npm / yarn
Package
- Name
- yarn
- View open source insights on deps.dev
- Purl
- pkg:npm/yarn