CVE-2020-8910 Auth Bypass in Google's Closure-Library
An attacker can exploit a URL parsing flaw in the Google Closure Library to bypass security checks by returning incorrect authority information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-8910?
CVE-2020-8910 is a medium-severity authentication bypass vulnerability in Google Closure-Library, published on 26 Mar 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A URL parsing issue in goog.uri of the Google Closure Library versions up to and including v20200224 allows an attacker to send malicious URLs to be parsed by the library and return the wrong authority. Mitigation: update your library to version v20200315.
Weakness: CWE-625
Which versions are affected by CVE-2020-8910?
2 open source packages ship an affected version, including google-closure-library. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
google-closure-library npm | All versions | 20200315.0.0 |
google-closure-library npm | All versions | 20200315.0.0 |
Products include Google Closure Library.
How do I fix CVE-2020-8910?
Upgrade google-closure-library to 20200315.0.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2020-8910 being exploited?
There is no known exploitation of CVE-2020-8910 in the wild and no public exploit code.
Sources
Also known as GHSA-vh5w-fg69-rc8m, UBUNTU-CVE-2020-8910.