Critical severity · published Oct 27, 2022
CVE-2022-3095
Incorrect parsing of the backslash characters in Dart library
9.8
CVSS
1.2%
EPSS
No
On KEV
Description
The implementation of backslash parsing in the Dart URI class for versions prior to 2.18 and Flutter versions prior to 3.30 differs from the WhatWG URL standards. Dart uses the RFC 3986 syntax, which creates incompatibilities with the '\' characters in URIs, which can lead to auth bypass in webapps interpreting URIs. We recommend updating Dart or Flutter to mitigate the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DA
Dart · Google LLC
stable before 2.18.2; Flutter before 3.3.3 · source: vendor
DS
Dart Software Development Kit · Dart
before 2.18.0 · source: NVD
FL
Flutter · Flutter
before 3.3.3 · source: NVD