CVE-2022-3095
Critical
Description
The implementation of backslash parsing in the Dart URI class for versions prior to 2.18 and Flutter versions prior to 3.30 differs from the WhatWG URL standards. Dart uses the RFC 3986 syntax, which creates incompatibilities with the '\' characters in URIs, which can lead to auth bypass in webapps interpreting URIs. We recommend updating Dart or Flutter to mitigate the issue.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Dart Software Development Kit
PublishedOct 27, 2022
First seenOct 27, 2022
Weakness typeCWE-20Improper input validation
How to fix
Update
- dart dart_software_development_kit2.18.0 or later
- flutter flutter3.3.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dart dart_software_development_kit | v < 2.18.0 | 2.18.0 |
| flutter flutter | v < 3.3.3 | 3.3.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.