← Zuruck zu CVEs
CVE-2022-0451
MEDIUM6.5
Beschreibung
Dart SDK contains the HTTPClient in dart:io library whcih includes authorization headers when handling cross origin redirects. These headers may be explicitly set and contain sensitive information. By default, HttpClient handles redirection logic. If a request is sent to example.com with authorization header and it redirects to an attackers site, they might not expect attacker site to receive authorization header. We recommend updating the Dart SDK to version 2.16.0 or beyond.
CVE Details
CVSS v3.1 Bewertung6.5
SchweregradMEDIUM
CVSS VektorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
AngriffsvektorNETWORK
KomplexitatLOW
Erforderliche PrivilegienLOW
BenutzerinteraktionNONE
Veroffentlicht2/18/2022
Zuletzt geandert11/21/2024
Quellenvd
Honeypot-Sichtungen0
Betroffene Produkte
dart:dart_software_development_kit
Schwachen (CWE)
CWE-305CWE-863
Referenzen
https://dart-review.googlesource.com/c/sdk/+/229947(cve-coordination@google.com)
https://github.com/dart-lang/sdk/commit/57db739be0ad4629079bfa94840064f615d35abc(cve-coordination@google.com)
https://dart-review.googlesource.com/c/sdk/+/229947(af854a3a-2127-422b-91ae-364da2661108)
https://github.com/dart-lang/sdk/commit/57db739be0ad4629079bfa94840064f615d35abc(af854a3a-2127-422b-91ae-364da2661108)
IOC Korrelationen
Keine Korrelationen erfasst
This product uses data from the NVD API but is not endorsed or certified by the NVD.