CVE-2020-8910 - Vulnerability Details - OpenCVE

Description

A URL parsing issue in goog.uri of the Google Closure Library versions up to and including v20200224 allows an attacker to send malicious URLs to be parsed by the library and return the wrong authority. Mitigation: update your library to version v20200315.

Published: 2020-03-26

Score: 6.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

No analysis available yet.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Google

Closure-Library

affected

Version	Status	Constraints
`v20200224`	affected	≤ v20200224

Configuration 1 [-]

cpe:2.3:a:google:closure_library:*:*:*:*:*:*:*:*

No data.

No data available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2021-1203	A URL parsing issue in goog.uri of the Google Closure Library versions up to and including v20200224 allows an attacker to send malicious URLs to be parsed by the library and return the wrong authority. Mitigation: update your library to version v20200315.
Github GHSA	GHSA-vh5w-fg69-rc8m	Improper Input Validation in Google Closure Library

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.0015.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://github.com/google/closure-library/commit/294fc00b01d248419d8f8de37580adf2a0024fc9
https://github.com/google/closure-library/releases/tag/v20200315

History

No history.

Subscriptions

Google Closure Library

MITRE

Status: PUBLISHED

Assigner: Google

Published: 2020-03-26T11:38:26.000Z

Updated: 2024-08-04T10:12:10.953Z

Reserved: 2020-02-12T00:00:00.000Z

Link: CVE-2020-8910

Vulnrichment

No data.

NVD

Status : Modified

Published: 2020-03-26T12:15:12.060

Modified: 2024-11-21T05:39:40.350

Link: CVE-2020-8910

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

{"containers": {"cna": {"affected": [{"product": "Closure-Library", "vendor": "Google", "versions": [{"lessThanOrEqual": "v20200224", "status": "affected", "version": "v20200224", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "David Sch\u00fctz"}, {"lang": "en", "value": "Fran\u00e7ois Lajeunesse-Robert"}], "descriptions": [{"lang": "en", "value": "A URL parsing issue in goog.uri of the Google Closure Library versions up to and including v20200224 allows an attacker to send malicious URLs to be parsed by the library and return the wrong authority. Mitigation: update your library to version v20200315."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-625", "description": "cwe-625", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"description": "Bad URL parsing", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-03-26T11:38:26.000Z", "orgId": "14ed7db2-1595-443d-9d34-6215bf890778", "shortName": "Google"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/google/closure-library/commit/294fc00b01d248419d8f8de37580adf2a0024fc9"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/google/closure-library/releases/tag/v20200315"}], "source": {"discovery": "EXTERNAL"}, "title": "Auth Bypass in Google's Closure-Library", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@google.com", "ID": "CVE-2020-8910", "STATE": "PUBLIC", "TITLE": "Auth Bypass in Google's Closure-Library"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Closure-Library", "version": {"version_data": [{"version_affected": "<=", "version_name": "v20200224", "version_value": "v20200224"}]}}]}, "vendor_name": "Google"}]}}, "credit": [{"lang": "eng", "value": "David Sch\u00fctz"}, {"lang": "eng", "value": "Fran\u00e7ois Lajeunesse-Robert"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A URL parsing issue in goog.uri of the Google Closure Library versions up to and including v20200224 allows an attacker to send malicious URLs to be parsed by the library and return the wrong authority. Mitigation: update your library to version v20200315."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "cwe-625"}]}, {"description": [{"lang": "eng", "value": "Bad URL parsing"}]}]}, "references": {"reference_data": [{"name": "https://github.com/google/closure-library/commit/294fc00b01d248419d8f8de37580adf2a0024fc9", "refsource": "CONFIRM", "url": "https://github.com/google/closure-library/commit/294fc00b01d248419d8f8de37580adf2a0024fc9"}, {"name": "https://github.com/google/closure-library/releases/tag/v20200315", "refsource": "CONFIRM", "url": "https://github.com/google/closure-library/releases/tag/v20200315"}]}, "source": {"discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T10:12:10.953Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/google/closure-library/commit/294fc00b01d248419d8f8de37580adf2a0024fc9"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/google/closure-library/releases/tag/v20200315"}]}]}, "cveMetadata": {"assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778", "assignerShortName": "Google", "cveId": "CVE-2020-8910", "datePublished": "2020-03-26T11:38:26.000Z", "dateReserved": "2020-02-12T00:00:00.000Z", "dateUpdated": "2024-08-04T10:12:10.953Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:google:closure_library:*:*:*:*:*:*:*:*", "matchCriteriaId": "CD86BB43-BF0F-4DF8-B746-9F597D81BF3D", "versionEndExcluding": "20200315", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A URL parsing issue in goog.uri of the Google Closure Library versions up to and including v20200224 allows an attacker to send malicious URLs to be parsed by the library and return the wrong authority. Mitigation: update your library to version v20200315."}, {"lang": "es", "value": "Un problema de an\u00e1lisis de URL en goog.uri de la Google Closure Library versiones hasta v20200224 incluy\u00e9ndola, permite a un atacante enviar URLs maliciosas para que sean analizadas por la biblioteca y devuelva la autoridad errada. Mitigaci\u00f3n: actualice su biblioteca a la versi\u00f3n v20200315."}], "id": "CVE-2020-8910", "lastModified": "2024-11-21T05:39:40.350", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "cve-coordination@google.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-03-26T12:15:12.060", "references": [{"source": "cve-coordination@google.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/google/closure-library/commit/294fc00b01d248419d8f8de37580adf2a0024fc9"}, {"source": "cve-coordination@google.com", "tags": ["Third Party Advisory"], "url": "https://github.com/google/closure-library/releases/tag/v20200315"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/google/closure-library/commit/294fc00b01d248419d8f8de37580adf2a0024fc9"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/google/closure-library/releases/tag/v20200315"}], "sourceIdentifier": "cve-coordination@google.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-625"}], "source": "cve-coordination@google.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}