CVE-2022-0451
Assigner: Google
Published: 2022-02-03T00:00:00
State: PUBLISHED
affected: product: Dart SDK
vendor: Google LLC
versions: lessThan: 2.16.0
status: affected
version: unspecified
versionType: custom
datePublic: 2022-02-03T00:00:00
descriptions: value: Dart SDK contains the HTTPClient in dart:io library whcih includes authorization headers when handling cross origin redirects. These headers may be explicitly set and contain sensitive information. By default, HttpClient handles redirection logic. If a request is sent to example.com with authorization header and it redirects to an attackers site, they might not expect attacker site to receive authorization header. We recommend updating the Dart SDK to version 2.16.0 or beyond.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
problemTypes: descriptions: cweId: CWE-305
description: CWE-305 Authentication Bypass by Primary Weakness
type: CWE
source: discovery: INTERNAL
title: Auth bypass in Dark SDK
x_generator: engine: Vulnogram 0.0.9