Skip to content
Sign in
6.5 Medium

CVE-2022-0451 Dart SDK contains the HTTPClient in dart:io library whcih includes authorization headers when handling cross origin…

Description

Dart SDK contains the HTTPClient in dart:io library whcih includes authorization headers when handling cross origin redirects. These headers may be explicitly set and contain sensitive information. By default, HttpClient handles redirection logic. If a request is sent to example.com with authorization header and it redirects to an attackers site, they might not expect attacker site to receive authorization header. We recommend updating the Dart SDK to version 2.16.0 or beyond.

Affected products and versions

Product Affected versions Fixed in
Dart SDK 2.16 earliest → < 2.16.0 2.16.0

Other CVEs of Dart SDK

The 4 CVEs of Dart SDK →
CVE-2021-22567 Bidirectional Unicode text can be interpreted and compiled differently than how it appears in editors which can be… 4.6 Medium CVE-2021-22568 When using the dart pub publish command to publish a package to a third-party package server, the request would be… 8.8 High CVE-2021-22540 Bad validation logic in the Dart SDK versions prior to 2.12.3 allow an attacker to use an XSS attack via DOM clobbering Not rated
Track this CVE