VDB
CVE-2022-0451
CVE-2022-0451
PUBLISHED
CVSS 6.5 MEDIUM
Dart SDK contains the HTTPClient in dart:io library whcih includes authorization headers when handling cross origin redirects. These headers may be explicitly set and contain sensitive information. By default, HttpClient handles redirection logic. If a request is sent to example.com with authorization header and it redirects to an attackers site, they might not expect attacker site to receive authorization header. We recommend updating the Dart SDK to version 2.16.0 or beyond.
EPSS 1.00% · 61.2th percentile
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS Score
1.00%
61.2th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Google LLC | Dart SDK | unspecified |
| dart | dart_software_development_kit | 0 |
Timeline
- Feb 18, 2022 CVE Published
- Feb 19, 2022 EPSS Score
- Apr 12, 2022 EPSS Score
- Jun 4, 2022 EPSS Score
- Jul 27, 2022 EPSS Score
- Sep 18, 2022 EPSS Score
- Nov 9, 2022 EPSS Score
- Jan 1, 2023 EPSS Score
- Feb 22, 2023 EPSS Score
- Apr 16, 2023 EPSS Score
- Jun 7, 2023 EPSS Score
- Jul 30, 2023 EPSS Score