CVE-2020-8923

Published Mar 26, 2020

Last updated 3 months ago

CVSS medium 5.4

Overview

Description: An improper HTML sanitization in Dart versions up to and including 2.7.1 and dev versions 2.8.0-dev.16.0, allows an attacker leveraging DOM Clobbering techniques to skip the sanitization and inject custom html/javascript (XSS). Mitigation: update your Dart SDK to 2.7.2, and 2.8.0-dev.17.0 for the dev version. If you cannot update, we recommend you review the way you use the affected APIs, and pay special attention to cases where user-provided data is used to populate DOM nodes. Consider using Element.innerText or Node.text to populate DOM elements.
Source: cve-coordination@google.com
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 6.1
Impact score: 2.7
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Severity: MEDIUM

CVSS 2.0

Type: Primary
Base score: 4.3
Impact score: 2.9
Exploitability score: 8.6
Vector string: AV:N/AC:M/Au:N/C:N/I:P/A:N

Weaknesses

cve-coordination@google.com: CWE-79
nvd@nist.gov: CWE-79

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:dart:dart_software_development_kit:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "245EA6E1-858A-4EE0-8783-D6FC91C304F8",
            "versionEndExcluding": "2.7.2"
          },
          {
            "criteria": "cpe:2.3:a:dart:dart_software_development_kit:2.8.0:dev0.0:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6C378984-C1E4-4541-AF8F-F00950C27297"
          },
          {
            "criteria": "cpe:2.3:a:dart:dart_software_development_kit:2.8.0:dev1.0:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B7D246F3-B3A0-497A-8C5F-5ADC9735D3D9"
          },
          {
            "criteria": "cpe:2.3:a:dart:dart_software_development_kit:2.8.0:dev10.0:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "932257F3-0AC1-4181-A6E2-F05AA5458F0B"
          },
          {
            "criteria": "cpe:2.3:a:dart:dart_software_development_kit:2.8.0:dev11.0:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3604B788-12F5-4464-9264-D480A1CFEB4F"
          },
          {
            "criteria": "cpe:2.3:a:dart:dart_software_development_kit:2.8.0:dev12.0:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "5DCBC478-7046-44DF-ADF0-03D45E1A5C69"
          },
          {
            "criteria": "cpe:2.3:a:dart:dart_software_development_kit:2.8.0:dev13.0:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "85F43007-8E34-4B52-9D9D-4EBDF0C99BD5"
          },
          {
            "criteria": "cpe:2.3:a:dart:dart_software_development_kit:2.8.0:dev14.0:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E37CB132-888D-4D20-871D-50BC29FF497C"
          },
          {
            "criteria": "cpe:2.3:a:dart:dart_software_development_kit:2.8.0:dev15.0:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "CDAAE2E2-2BD9-41B8-903B-FA113B3074F0"
          },
          {
            "criteria": "cpe:2.3:a:dart:dart_software_development_kit:2.8.0:dev16.0:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0163439B-633A-475D-B7C3-56EBEDFA1A60"
          },
          {
            "criteria": "cpe:2.3:a:dart:dart_software_development_kit:2.8.0:dev2.0:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "33E498C7-7A01-4F27-ADED-679ADC702DA5"
          },
          {
            "criteria": "cpe:2.3:a:dart:dart_software_development_kit:2.8.0:dev3.0:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0E2FE06D-3A1F-4051-865F-29DDD4CC4ADB"
          },
          {
            "criteria": "cpe:2.3:a:dart:dart_software_development_kit:2.8.0:dev4.0:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BB27262C-0156-47AE-B9EF-CFA1748AF9BA"
          },
          {
            "criteria": "cpe:2.3:a:dart:dart_software_development_kit:2.8.0:dev5.0:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "24BCF25D-D5F5-49A1-9209-3C2F88A10516"
          },
          {
            "criteria": "cpe:2.3:a:dart:dart_software_development_kit:2.8.0:dev6.0:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2417EDC0-751B-4DE9-A61B-885175855D58"
          },
          {
            "criteria": "cpe:2.3:a:dart:dart_software_development_kit:2.8.0:dev7.0:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DE211D61-1029-4987-8B1C-C1791FEF53D4"
          },
          {
            "criteria": "cpe:2.3:a:dart:dart_software_development_kit:2.8.0:dev8.0:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B7066A39-DD04-47EB-9F67-DC4A7285B864"
          },
          {
            "criteria": "cpe:2.3:a:dart:dart_software_development_kit:2.8.0:dev9.0:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "71C09C17-1558-401E-AA73-F4B1C2BAD816"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Risk scores

CVSS 3.1

CVSS 2.0

Weaknesses

Social media

Configurations

References