CVE-2020-8910 - Vulnerability Details - OpenCVE

A URL parsing issue in goog.uri of the Google Closure Library versions up to and including v20200224 allows an attacker to send malicious URLs to be parsed by the library and return the wrong authority. Mitigation: update your library to version v20200315.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00072.

Key SSVC decision points have not yet been added.

Vendors	Products
Google	Closure Library

Configuration 1 [-]

cpe:2.3:a:google:closure_library:*:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2021-1203	A URL parsing issue in goog.uri of the Google Closure Library versions up to and including v20200224 allows an attacker to send malicious URLs to be parsed by the library and return the wrong authority. Mitigation: update your library to version v20200315.
Github GHSA	GHSA-vh5w-fg69-rc8m	Improper Input Validation in Google Closure Library

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/google/closure-library/commit/294fc00b01d248419d8f8de37580adf2a0024fc9
https://github.com/google/closure-library/releases/tag/v20200315

History

No history.

MITRE

Status: PUBLISHED

Assigner: Google

Published: 2020-03-26T11:38:26

Updated: 2024-08-04T10:12:10.953Z

Reserved: 2020-02-12T00:00:00

Link: CVE-2020-8910

Vulnrichment

No data.

NVD

Status : Modified

Published: 2020-03-26T12:15:12.060

Modified: 2024-11-21T05:39:40.350

Link: CVE-2020-8910

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "Closure-Library", "vendor": "Google", "versions": [{"lessThanOrEqual": "v20200224", "status": "affected", "version": "v20200224", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "David Sch\u00fctz"}, {"lang": "en", "value": "Fran\u00e7ois Lajeunesse-Robert"}], "descriptions": [{"lang": "en", "value": "A URL parsing issue in goog.uri of the Google Closure Library versions up to and including v20200224 allows an attacker to send malicious URLs to be parsed by the library and return the wrong authority. Mitigation: update your library to version v20200315."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-625", "description": "cwe-625", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"description": "Bad URL parsing", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-03-26T11:38:26", "orgId": "14ed7db2-1595-443d-9d34-6215bf890778", "shortName": "Google"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/google/closure-library/commit/294fc00b01d248419d8f8de37580adf2a0024fc9"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/google/closure-library/releases/tag/v20200315"}], "source": {"discovery": "EXTERNAL"}, "title": "Auth Bypass in Google's Closure-Library", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@google.com", "ID": "CVE-2020-8910", "STATE": "PUBLIC", "TITLE": "Auth Bypass in Google's Closure-Library"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Closure-Library", "version": {"version_data": [{"version_affected": "<=", "version_name": "v20200224", "version_value": "v20200224"}]}}]}, "vendor_name": "Google"}]}}, "credit": [{"lang": "eng", "value": "David Sch\u00fctz"}, {"lang": "eng", "value": "Fran\u00e7ois Lajeunesse-Robert"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A URL parsing issue in goog.uri of the Google Closure Library versions up to and including v20200224 allows an attacker to send malicious URLs to be parsed by the library and return the wrong authority. Mitigation: update your library to version v20200315."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "cwe-625"}]}, {"description": [{"lang": "eng", "value": "Bad URL parsing"}]}]}, "references": {"reference_data": [{"name": "https://github.com/google/closure-library/commit/294fc00b01d248419d8f8de37580adf2a0024fc9", "refsource": "CONFIRM", "url": "https://github.com/google/closure-library/commit/294fc00b01d248419d8f8de37580adf2a0024fc9"}, {"name": "https://github.com/google/closure-library/releases/tag/v20200315", "refsource": "CONFIRM", "url": "https://github.com/google/closure-library/releases/tag/v20200315"}]}, "source": {"discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T10:12:10.953Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/google/closure-library/commit/294fc00b01d248419d8f8de37580adf2a0024fc9"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/google/closure-library/releases/tag/v20200315"}]}]}, "cveMetadata": {"assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778", "assignerShortName": "Google", "cveId": "CVE-2020-8910", "datePublished": "2020-03-26T11:38:26", "dateReserved": "2020-02-12T00:00:00", "dateUpdated": "2024-08-04T10:12:10.953Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:google:closure_library:*:*:*:*:*:*:*:*", "matchCriteriaId": "CD86BB43-BF0F-4DF8-B746-9F597D81BF3D", "versionEndExcluding": "20200315", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A URL parsing issue in goog.uri of the Google Closure Library versions up to and including v20200224 allows an attacker to send malicious URLs to be parsed by the library and return the wrong authority. Mitigation: update your library to version v20200315."}, {"lang": "es", "value": "Un problema de an\u00e1lisis de URL en goog.uri de la Google Closure Library versiones hasta v20200224 incluy\u00e9ndola, permite a un atacante enviar URLs maliciosas para que sean analizadas por la biblioteca y devuelva la autoridad errada. Mitigaci\u00f3n: actualice su biblioteca a la versi\u00f3n v20200315."}], "id": "CVE-2020-8910", "lastModified": "2024-11-21T05:39:40.350", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "cve-coordination@google.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-03-26T12:15:12.060", "references": [{"source": "cve-coordination@google.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/google/closure-library/commit/294fc00b01d248419d8f8de37580adf2a0024fc9"}, {"source": "cve-coordination@google.com", "tags": ["Third Party Advisory"], "url": "https://github.com/google/closure-library/releases/tag/v20200315"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/google/closure-library/commit/294fc00b01d248419d8f8de37580adf2a0024fc9"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/google/closure-library/releases/tag/v20200315"}], "sourceIdentifier": "cve-coordination@google.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-625"}], "source": "cve-coordination@google.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}