CVE-2019-15608
MEDIUM 5.9EPSS 1.8%
The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack.
- Affected
- yarn
- CVSS v3.1 NVD
- 5.9 MEDIUM
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS v2.0 NVD
- 4.3 MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N - EPSS
- 1.84% chance of exploitation in the next 30 days, 79th percentile
- Published
- 2020-03-15
- Updated
- 2024-08-05