CVE-2021-22568

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2021-22568

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-22568.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2021-22568

Aliases

GHSA-r32f-vhjp-qhj7

Published

2021-12-09T17:15:07Z

Modified

2026-07-09T14:06:39Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L CVSS Calculator

Summary

[none]

Details

When using the dart pub publish command to publish a package to a third-party package server, the request would be authenticated with an oauth2 access_token that is valid for publishing on pub.dev. Using these obtained credentials, an attacker can impersonate the user on pub.dev. We recommend upgrading past https://github.com/dart-lang/sdk/commit/d787e78d21e12ec1ef712d229940b1172aafcdf8 or beyond version 2.15.0

References

Affected packages

Git / github.com/dart-lang/sdk

Affected ranges

Type

GIT

Repo

https://github.com/dart-lang/sdk

Events

Introduced

Fixed

3d2629cd0310df74bdf260d828ed3c75f25db889

Fixed

d787e78d21e12ec1ef712d229940b1172aafcdf8

Database specific

Show details

{
    "cpe": "cpe:2.3:a:dart:dart_software_development_kit:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.15.0"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

1.*

1.11.0

1.11.0-dev.2.0

1.11.0-dev.3.0

1.11.0-dev.4.0

1.11.0-dev.5.0

1.11.0-dev.5.1

1.11.0-dev.5.2

1.11.0-dev.5.3

1.11.0-dev.5.4

1.11.0-dev.5.5

1.11.0-dev.5.6

1.11.0-dev.5.7

1.11.1

1.11.2

1.11.3

1.12.0

1.12.1

1.12.2

1.13.0

1.13.1

1.13.2

1.14.0

1.14.1

1.14.2

1.15.0

1.16.0

1.16.1

1.17.0

1.17.1

1.18.0

1.18.1

1.19.0

1.19.1

1.20.0

1.20.1

1.21.0

1.21.1

1.22.0

1.22.1

1.23.0

1.24.0

1.24.1

1.24.2

1.24.3

2.*

2.0.0

2.1.0

2.1.1

2.10.0

2.10.1

2.10.2

2.10.3

2.10.4

2.10.5

2.12.0

2.12.1

2.12.2

2.12.3

2.12.4

2.13.0

2.13.1

2.13.3

2.13.4

2.14.0

2.14.1

2.14.2

2.14.3

2.14.4

2.2.0

2.3.0

2.3.1

2.3.2

2.4.0

2.4.1

2.5.0

2.5.1

2.5.2

2.6.0

2.6.1

2.7.0

2.7.1

2.7.2

2.8.1

2.8.2

2.8.3

2.8.4

2.9.0

2.9.1

2.9.2

2.9.3

analyzer-0.*

analyzer-0.31.0

analyzer-0.31.0+1

analyzer-0.31.1

analyzer-0.31.2-alpha.0

analyzer-0.31.2-alpha.1

analyzer-0.31.2-alpha.2

analyzer-0.32.0

analyzer-0.32.4

analyzer-0.33.0

Other

merge_analyzer_branch

meta-v1.*

meta-v1.3.0-nullsafety.1

meta-v1.3.0-nullsafety.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-22568.json"