CVE-2019-19251

2019-12-1015:15:12

Google

osv.dev

6.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

36.1%

JSON

The Last.fm desktop app (Last.fm Scrobbler) through 2.1.39 on macOS makes HTTP requests that include an API key without the use of SSL/TLS. Although there is an Enable SSL option, it is disabled by default, and cleartext requests are made as soon as the app starts.

CPENameOperatorVersion
lastfm-desktopeq2.1.39
lastfm-desktopeq2.1.28
lastfm-desktopeq2.1.25
lastfm-desktopeq2.1.34
lastfm-desktopeq2.1.31
lastfm-desktopeq2.1.38-beta1
lastfm-desktopeq2.1.29
lastfm-desktopeq2.1.33
lastfm-desktopeq2.1.27
lastfm-desktopeq2.1.38-beta2

Name	Operator	Version
lastfm-desktop	eq	2.1.39
lastfm-desktop	eq	2.1.28
lastfm-desktop	eq	2.1.25
lastfm-desktop	eq	2.1.34
lastfm-desktop	eq	2.1.31
lastfm-desktop	eq	2.1.38-beta1
lastfm-desktop	eq	2.1.29
lastfm-desktop	eq	2.1.33
lastfm-desktop	eq	2.1.27
lastfm-desktop	eq	2.1.38-beta2