CVE-2020-8910

A URL parsing issue in goog.uri of the Google Closure Library versions up to and including v20200224 allows an attacker to send malicious URLs to be parsed by the library and return the wrong authority. Mitigation: update your library to version v20200315.

CVSS v3 6.5 MEDIUM
CVSS v2.0 4.3 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://github.com/google/closure-library/commit/294fc00b01d248419d8f8de37580adf2a0024fc9	Patch Third Party Advisory
https://github.com/google/closure-library/releases/tag/v20200315	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:google:closure_library:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-03-26 12:15

Updated : 2024-02-04 21:00

NVD link : CVE-2020-8910

Mitre link : CVE-2020-8910

CVE.ORG link : CVE-2020-8910

JSON object : View

Products Affected

google

closure_library

CWE

NVD-CWE-noinfo CWE-625

Permissive Regular Expression

{"id": "CVE-2020-8910", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "cve-coordination@google.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2020-03-26T12:15:12.060", "references": [{"url": "https://github.com/google/closure-library/commit/294fc00b01d248419d8f8de37580adf2a0024fc9", "tags": ["Patch", "Third Party Advisory"], "source": "cve-coordination@google.com"}, {"url": "https://github.com/google/closure-library/releases/tag/v20200315", "tags": ["Third Party Advisory"], "source": "cve-coordination@google.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "cve-coordination@google.com", "description": [{"lang": "en", "value": "CWE-625"}]}], "descriptions": [{"lang": "en", "value": "A URL parsing issue in goog.uri of the Google Closure Library versions up to and including v20200224 allows an attacker to send malicious URLs to be parsed by the library and return the wrong authority. Mitigation: update your library to version v20200315."}, {"lang": "es", "value": "Un problema de an\u00e1lisis de URL en goog.uri de la Google Closure Library versiones hasta v20200224 incluy\u00e9ndola, permite a un atacante enviar URLs maliciosas para que sean analizadas por la biblioteca y devuelva la autoridad errada. Mitigaci\u00f3n: actualice su biblioteca a la versi\u00f3n v20200315."}], "lastModified": "2023-11-07T03:26:47.340", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:google:closure_library:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CD86BB43-BF0F-4DF8-B746-9F597D81BF3D", "versionEndExcluding": "20200315"}], "operator": "OR"}]}], "sourceIdentifier": "cve-coordination@google.com"}