CVE Vulnerability

CVE-2022-3095

The implementation of backslash parsing in the Dart URI class for versions prior to 2.18 and Flutter versions prior to 3.30 differs from the WhatWG URL standards. Dart uses the RFC 3986 syntax, which creates incompatibilities with the '' characters in URIs, which can lead to auth bypass in webapps interpreting URIs. We recommend updating Dart or Flutter to mitigate the issue.

9.8 /10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/dart-lang/sdk/blob/master/CHANGELOG.md#2182---2022-09-28 Release Notes Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:dart:dart_software_development_kit:*:*:*:*:*:*:*:*
cpe:2.3:a:flutter:flutter:*:*:*:*:*:*:*:*
Information

Published : 2022-10-27 04:15

Updated : 2022-10-31 04:20

NVD link : CVE-2022-3095

Mitre link : CVE-2022-3095

Products Affected
No products.
CWE
NVD-CWE-noinfo