CVE-2020-8910 Auth Bypass in Google's Closure-Library

2020-03-2611:38:26

CWE-625

Google

www.cve.org

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

36.4%

JSON

A URL parsing issue in goog.uri of the Google Closure Library versions up to and including v20200224 allows an attacker to send malicious URLs to be parsed by the library and return the wrong authority. Mitigation: update your library to version v20200315.

CNA Affected

[
  {
    "product": "Closure-Library",
    "vendor": "Google",
    "versions": [
      {
        "lessThanOrEqual": "v20200224",
        "status": "affected",
        "version": "v20200224",
        "versionType": "custom"
      }
    ]
  }
]