What’s Vulnerable › Vulnerabilities

CVE-2019-9149

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-07-09 · updated 2026-06-17
• Weakness: CWE-347

Description

Mailvelope prior to 3.3.0 allows private key operations without user interaction via its client-API. By modifying an URL parameter in Mailvelope, an attacker is able to sign (and encrypt) arbitrary messages with Mailvelope, assuming the private key password is cached. A second vulnerability allows an attacker to decrypt an arbitrary message when the GnuPG backend is used in Mailvelope.

Affected products

• Mailvelope: before 3.3.0 — fixed in 3.3.0

How to fix

Upgrade to a fixed version: Mailvelope 3.3.0. Check the vendor advisory for mitigations.

References

• https://github.com/mailvelope/mailvelope/blob/master/Changelog.md#v330
• https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.html
• https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.pdf?__blob=publicationFile&v=3
• https://github.com/mailvelope/mailvelope/blob/master/Changelog.md#v330
• https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.html
• https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.pdf?__blob=publicationFile&v=3

Get alerted when CVE-2019-9149 or the next vulnerability affects your stack