CVE-2022-3095 Incorrect parsing of the backslash characters in Dart library
Incorrect backslash parsing in Dart URI class allows authentication bypass in web applications interpreting URIs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-3095?
CVE-2022-3095 is a critical authentication bypass vulnerability in Google LLC Dart, published on 27 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The implementation of backslash parsing in the Dart URI class for versions prior to 2.18 and Flutter versions prior to 3.30 differs from the WhatWG URL standards. Dart uses the RFC 3986 syntax, which creates incompatibilities with the '\' characters in URIs, which can lead to auth bypass in webapps interpreting URIs. We recommend updating Dart or Flutter to mitigate the issue.
Weakness: CWE-20
Which versions are affected by CVE-2022-3095?
It affects 2 products.
Products include Dart Dart Software Development Kit, Flutter Flutter.
How do I fix CVE-2022-3095?
No fix has been published for CVE-2022-3095 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2022-3095 being exploited?
There is no known exploitation of CVE-2022-3095 in the wild and no public exploit code.