CVE-2021-22568
Using these obtained credentials, an attacker can impersonate the user on pub.dev.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.92%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
When using the dart pub publish command to publish a package to a third-party package server, the request would be authenticated with an oauth2 access_token that is valid for publishing on pub.dev. Using these obtained credentials, an attacker can impersonate the user on pub.dev. We recommend upgrading past https://github.com/dart-lang/sdk/commit/d787e78d21e12ec1ef712d229940b1172aafcdf8 or beyond version 2.15.0
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L
- EPSS
- 0.92% probability · 58th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-255, CWE-668
- Affected
- dart/dart software development kit
- Source
- cve-coordination@google.com
References
- https://github.com/dart-lang/sdk/blob/main/CHANGELOG.mdPatch, Third Party Advisory
- https://github.com/dart-lang/sdk/commit/d787e78d21e12ec1ef712d229940b1172aafcdf8Patch, Third Party Advisory
- https://github.com/dart-lang/sdk/security/advisories/GHSA-r32f-vhjp-qhj7Issue Tracking
- https://github.com/dart-lang/sdk/blob/main/CHANGELOG.mdPatch, Third Party Advisory
- https://github.com/dart-lang/sdk/commit/d787e78d21e12ec1ef712d229940b1172aafcdf8Patch, Third Party Advisory
- https://github.com/dart-lang/sdk/security/advisories/GHSA-r32f-vhjp-qhj7Issue Tracking
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.