CVE-2020-35669

MEDIUM EPSS 79.9%
Published Dec 24, 20205y ago · Modified Jun 17, 20262w ago
6.1 CVSS 3.1
Medium
Find Similar
Published Dec 24, 2020 5y ago
Last Modified Jun 17, 2026 2w ago

Description

An issue was discovered in the http package through 0.12.2 for Dart. If the attacker controls the HTTP method and the app is using Request directly, it's possible to achieve CRLF injection in an HTTP request.

CVSS Details

Base Score
6.1
Exploitability
2.8
Impact
2.7
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Changed
Confidentiality Low
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
79.9% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-74

Affected Products 1

VendorProductVersionRange
darthttp* ≤0.12.2

References 2

  • github.com https://github.com/dart-lang/http/blob/master/CHANGELOG.md#0133
    Broken LinkRelease NotesThird Party Advisory
  • github.com https://github.com/dart-lang/http/issues/511
    ExploitPatchThird Party Advisory

Remediation

  • github.com https://github.com/dart-lang/http/issues/511
    ExploitPatchThird Party Advisory