CVE-2019-9149

Mailvelope prior to 3.3.0 allows private key operations without user interaction via its client-API. By modifying an URL parameter in Mailvelope, an attacker is able to sign (and encrypt) arbitrary messages with Mailvelope, assuming the private key password is cached. A second vulnerability allows an attacker to decrypt an arbitrary message when the GnuPG backend is used in Mailvelope.

• CWE-347
• CWE-863

• https://github.com/mailvelope/mailvelope/blob/master/Changelog.md#v330Release Notes, Third Party Advisory
• https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.htmlThird Party Advisory
• https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.pdf?__blob=publicationFile&v=3Exploit, Third Party Advisory
• https://github.com/mailvelope/mailvelope/blob/master/Changelog.md#v330Release Notes, Third Party Advisory
• https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.htmlThird Party Advisory
• https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.pdf?__blob=publicationFile&v=3Exploit, Third Party Advisory

Published

Jul 9, 2019

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-9143An issue was discovered in Exiv2 0.27. There is infinite rec…
• CVE-2019-9144An issue was discovered in Exiv2 0.27. There is infinite rec…
• CVE-2019-9145An issue was discovered in Hsycms V1.1. There is an XSS vuln…
• CVE-2019-9146Jamf Self Service 10.9.0 allows man-in-the-middle attackers …
• CVE-2019-9147Mailvelope prior to 3.1.0 is vulnerable to a clickjacking at…
• CVE-2019-9148Mailvelope prior to 3.3.0 accepts or operates with invalid P…4.3
• CVE-2019-9150Mailvelope prior to 3.3.0 does not require user interaction …
• CVE-2019-9151An issue was discovered in the HDF HDF5 1.10.4 library. Ther…
• CVE-2019-9152An issue was discovered in the HDF HDF5 1.10.4 library. Ther…
• CVE-2019-9153Improper Verification of a Cryptographic Signature in OpenPG…
• CVE-2019-9154Improper Verification of a Cryptographic Signature in OpenPG…
• CVE-2019-9155A cryptographic issue in OpenPGP.js <=4.2.0 allows an attack…