CVE-2022-0451

Katalog CVE

CVSS 6.5 · Medium EPSS 1,00%

Kerentanan Authentication Bypass by Primary Weakness pada dart software development kit. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Dart SDK contains the HTTPClient in dart:io library whcih includes authorization headers when handling cross origin redirects. These headers may be explicitly set and contain sensitive information. By default, HttpClient handles redirection logic. If a request is sent to example.com with authorization header and it redirects to an attackers site, they might not expect attacker site to receive authorization header. We recommend updating the Dart SDK to version 2.16.0 or beyond.

Rincian

Terbit di NVD

18 Februari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-305: Authentication Bypass by Primary Weakness
CWE-863: Incorrect Authorization

EPSS (30 hari)

1,00% peluang dieksploitasi; lebih tinggi dari 61,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://dart-review.googlesource.com/c/sdk/+/229947 issue tracking · patch · advisory pihak ketiga
• https://github.com/dart-lang/sdk/commit/57db739be0ad4629079bfa94840064f615d35abc patch · advisory pihak ketiga