CVE-2020-8910CWE-625

Auth Bypass in Google's Closure-Library

Medium · published March 26, 2020

CVSS v3.1
6.5
EPSS
1%
Percentile
44.4
In the wild
Unconfirmed
What it is

A URL parsing issue in goog.uri of the Google Closure Library versions up to and including v20200224 allows an attacker to send malicious URLs to be parsed by the library and return the wrong authority. Mitigation: update your library to version v20200315.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00537 · 44.4th percentile
Weakness
CWE-625 · Permissive Regular Expression
Published
2020-03-26T11:38Z
EPSS history
Timeline
  • 26 MAR 11:38Z
    Auth Bypass in Google's Closure-Library
    cvelistv5