CVE-2022-0451mediumCWE-305

CVE-2022-0451: falha de média gravidade em Google LLC Dart SDK

Auth bypass in Dark SDK

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Dart SDK

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 1.0%
Dart SDK contains the HTTPClient in dart:io library whcih includes authorization headers when handling cross origin redirects. These headers may be explicitly set and contain sensitive information. By default, HttpClient handles redirection logic. If a request is sent to example.com with authorization header and it redirects to an attackers site, they might not expect attacker site to receive authorization header. We recommend updating the Dart SDK to version 2.16.0 or beyond.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
Google LLC · Dart SDK
CVEs relacionadas — Google LLC Dart SDK

No mesmo produto, das mais perigosas para as menos.

CVE-2021-22568HIGHDart - Publishing to third-party package repositories may expose pub.dev credentialsEPSS 0.9%CVE-2021-22540—XSS in Dart SDKEPSS 0.7%CVE-2021-22567MEDIUMBidirectional Override in Dart SDKEPSS 0.6%