CVE-2019-5448

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-311 CWE-319

Affected software

Vendor	Product	Versions
yarn	yarn	Fixed in 1.17.3

References

https://github.com/ChALkeR/notes/blob/master/Yarn-vuln.mdExploit, Third Party Advisory
https://hackerone.com/reports/640904Permissions Required, Third Party Advisory
https://yarnpkg.com/blog/2019/07/12/recommended-security-update/Vendor Advisory
https://github.com/ChALkeR/notes/blob/master/Yarn-vuln.mdExploit, Third Party Advisory
https://hackerone.com/reports/640904Permissions Required, Third Party Advisory
https://yarnpkg.com/blog/2019/07/12/recommended-security-update/Vendor Advisory

Timeline

Published: Jul 30, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-54494.3A missing check in the Nextcloud Server prior to version 15.0.1 causes leaking of calendar event names when adding or modifying confidential CVE-2019-54506.8Improper sanitization of HTML in directory names in the Nextcloud Android app prior to version 3.7.0 allowed to style the directory name in CVE-2019-54514.6Bypass lock protection in the Nextcloud Android app prior to version 3.6.1 allows accessing the files when repeatedly opening and closing th CVE-2019-54522.4Bypass lock protection in the Nextcloud Android app prior to version 3.6.2 causes leaking of thumbnails when requesting the Android content CVE-2019-54536.1Bypass lock protection in the Nextcloud Android app prior to version 3.3.0 allowed access to files when being prompted for the lock protecti CVE-2019-54549.8SQL Injection in the Nextcloud Android app prior to version 3.0.0 allows to destroy a local cache when a harmful query is executed requiring CVE-2019-54556.8Bypassing lock protection exists in Nextcloud Android app 3.6.0 when creating a multi-account and aborting the process.CVE-2019-54568.1SMTP MITM refers to a malicious actor setting up an SMTP proxy server between the UniFi Controller version <= 5.10.21 and their actual SMTP CVE-2019-54575.4Cross-site scripting (XSS) vulnerability in min-http-server (all versions) allows an attacker with access to the server file system to execu CVE-2019-54585.4Cross-site scripting (XSS) vulnerability in http-file-server (all versions) allows an attacker with access to the server file system to exec CVE-2019-54597.1An Integer underflow in VLC Media Player versions < 3.0.7 leads to an out-of-band read.CVE-2019-54605.5Double Free in VLC versions <= 3.0.6 leads to a crash.