6.5
Moyenne
CVE-2022-0451 Dart SDK contains the HTTPClient in dart:io library whcih includes authorization headers when handling cross origin…
Description
Dart SDK contains the HTTPClient in dart:io library whcih includes authorization headers when handling cross origin redirects. These headers may be explicitly set and contain sensitive information. By default, HttpClient handles redirection logic. If a request is sent to example.com with authorization header and it redirects to an attackers site, they might not expect attacker site to receive authorization header. We recommend updating the Dart SDK to version 2.16.0 or beyond.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Dart SDK 2.16 | premières → < 2.16.0 | 2.16.0 |
Autres CVE de Dart SDK
Les 4 CVE de Dart SDK →
CVE-2021-22567
Bidirectional Unicode text can be interpreted and compiled differently than how it appears in editors which can be…
4.6
Moyenne
CVE-2021-22568
When using the dart pub publish command to publish a package to a third-party package server, the request would be…
8.8
Élevée
CVE-2021-22540
Bad validation logic in the Dart SDK versions prior to 2.12.3 allow an attacker to use an XSS attack via DOM clobbering
Non notée