Vulnerability · Published Jan 5, 2022 · Assigned by Google
CVE-2021-22567Bidirectional Override in Dart SDK
Medium 4.6
In plain English
A medium-severity improper access control in Dart SDK from Google LLC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).
Severity (CVSS 3.1)4.6Medium
Exploit odds (30 days)0.6%top 50.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Bidirectional Unicode text can be interpreted and compiled differently than how it appears in editors which can be exploited to get nefarious code passed a code review by appearing benign. An attacker could embed a source that is invisible to a code reviewer that modifies the behavior of a program in unexpected ways.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Google LLC | Dart SDK | unspecified – before 2.15.0-268.18.beta |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
References
- https://github.com/dart-lang/sdk/blob/main/CHANGELOG.md x_refsource_MISC
- https://github.com/dart-lang/sdk/commit/52519ea8eb4780c468c4c2ed00e7c8046ccfed41 x_refsource_MISC