VulnerabilityModified
CVE-2019-9150
Mailvelope prior to 3.3.0 does not require user interaction to import public keys shown on web page.
MEDIUM 5.3EPSS 1.38%
Does this matter?
Lower severity and a low EPSS score (1.38%). Track it; it rarely justifies an emergency change on its own.
Description
Mailvelope prior to 3.3.0 does not require user interaction to import public keys shown on web page. This functionality can be tricked to either hide a key import from the user or obscure which key was imported.
- CVSS 3.0
- 5.3 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- EPSS
- 1.38% probability · 71th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-320
- Affected
- mailvelope/mailvelope
- Source
- cve@mitre.org
References
- https://github.com/mailvelope/mailvelope/blob/master/Changelog.md#v330Release Notes, Third Party Advisory
- https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.html
- https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.pdf?__blob=publicationFile&v=3
- https://github.com/mailvelope/mailvelope/blob/master/Changelog.md#v330Release Notes, Third Party Advisory
- https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.html
- https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.pdf?__blob=publicationFile&v=3
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.