CVE-2022-0451

Dart SDK contains the HTTPClient in dart:io library whcih includes authorization headers when handling cross origin redirects. These headers may be explicitly set and contain sensitive information. By default, HttpClient handles redirection logic. If a request is sent to example.com with authorization header and it redirects to an attackers site, they might not expect attacker site to receive authorization header. We recommend updating the Dart SDK to version 2.16.0 or beyond.

CVSS v3 6.5 MEDIUM
CVSS v2.0 4.0 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://dart-review.googlesource.com/c/sdk/+/229947	Issue Tracking Patch Third Party Advisory
https://github.com/dart-lang/sdk/commit/57db739be0ad4629079bfa94840064f615d35abc	Patch Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:dart:dart_software_development_kit:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-02-18 14:15

Updated : 2024-02-28 19:09

NVD link : CVE-2022-0451

Mitre link : CVE-2022-0451

CVE.ORG link : CVE-2022-0451

JSON object : View

Products Affected

dart

dart_software_development_kit

CWE

CWE-863

Incorrect Authorization

CWE-305

Authentication Bypass by Primary Weakness

{"id": "CVE-2022-0451", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "cve-coordination@google.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2022-02-18T14:15:07.817", "references": [{"url": "https://dart-review.googlesource.com/c/sdk/+/229947", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "source": "cve-coordination@google.com"}, {"url": "https://github.com/dart-lang/sdk/commit/57db739be0ad4629079bfa94840064f615d35abc", "tags": ["Patch", "Third Party Advisory"], "source": "cve-coordination@google.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-863"}]}, {"type": "Secondary", "source": "cve-coordination@google.com", "description": [{"lang": "en", "value": "CWE-305"}]}], "descriptions": [{"lang": "en", "value": "Dart SDK contains the HTTPClient in dart:io library whcih includes authorization headers when handling cross origin redirects. These headers may be explicitly set and contain sensitive information. By default, HttpClient handles redirection logic. If a request is sent to example.com with authorization header and it redirects to an attackers site, they might not expect attacker site to receive authorization header. We recommend updating the Dart SDK to version 2.16.0 or beyond."}, {"lang": "es", "value": "Dart SDK contiene la biblioteca HTTPClient en dart:io que incluye encabezados de autorizaci\u00f3n cuando maneja redireccionamientos de origen cruzado. Estos encabezados pueden ser establecidas expl\u00edcitamente y contienen informaci\u00f3n confidencial. Por fallo, HttpClient maneja la l\u00f3gica de redirecci\u00f3n. Si es enviado una petici\u00f3n a example.com con un encabezado de autorizaci\u00f3n y es redirigido a un sitio de atacantes, \u00e9stos podr\u00edan no esperar que el sitio del atacante reciba el encabezado de autorizaci\u00f3n. Recomendamos actualizar Dart SDK a versi\u00f3n 2.16.0 o superior"}], "lastModified": "2022-02-26T03:06:33.100", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dart:dart_software_development_kit:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "17D69A94-FDC3-417E-B7EB-FD2CD8CCD8A3", "versionEndExcluding": "2.16.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve-coordination@google.com"}