CVE-2022-0451mediumCWE-305

CVE-2022-0451: fallo de gravedad media en Google LLC Dart SDK

Auth bypass in Dark SDK

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Dart SDK

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.5epss 1.0%
Dart SDK contains the HTTPClient in dart:io library whcih includes authorization headers when handling cross origin redirects. These headers may be explicitly set and contain sensitive information. By default, HttpClient handles redirection logic. If a request is sent to example.com with authorization header and it redirects to an attackers site, they might not expect attacker site to receive authorization header. We recommend updating the Dart SDK to version 2.16.0 or beyond.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Productos afectados
Google LLC · Dart SDK
CVEs relacionadas — Google LLC Dart SDK

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-22568HIGHDart - Publishing to third-party package repositories may expose pub.dev credentialsEPSS 0.9%CVE-2021-22540—XSS in Dart SDKEPSS 0.7%CVE-2021-22567MEDIUMBidirectional Override in Dart SDKEPSS 0.6%