CVSS 3.0
7.5 highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2015-8013
High (7.5) in openpgpjs openpgpjs. EPSS 3.9% chance of exploitation in the next 30 days. Fixed in openpgp 1.3.0.
s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted PGP keys which allows remote attackers to bypass authentication if message decryption is used as an authentication mechanism via a crafted symmetrically encrypted PGP message.
Severity
- EPSS
- 3.9% chance of exploitation in the next 30 days; higher than 90% of CVEs (scores of 2026-10-31)
- CWE
- CWE-310
- Published
- Modified
- Record from
- the NVD, synced
Affected
- openpgpjs:openpgpjs
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-qmvq-f3fj-m3wg | npm | openpgp | <1.3.0 | 1.3.0 |