CVE-2020-8910: Improper Input Validation in Google Closure Library
Summary
CVE-2020-8910: Improper Input Validation in Google Closure Library. Affects google-closure-library versions < 20200315.0.0. Fixed in 20200315.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Google Closure Library is a JavaScript library that provides a wide range of utilities and classes for building web applications. It offers features for DOM manipulation, event handling, network communication, and more. The library is widely used in various projects and frameworks. However, versions up to and including v20200224 of the library are vulnerable to an improper input validation issue in the goog.uri module.
Vulnerability Detail
The vulnerability arises from a URL parsing flaw in the goog.uri module of the Google Closure Library. An attacker can exploit this flaw by sending malicious URLs to be parsed by the library, which can result in the incorrect determination of the authority. This can lead to various security issues, such as cross-site scripting (XSS) attacks or unauthorized access to sensitive resources. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
20200315.0.0
This is the first release that contains the fix.
npm install google-closure-library@20200315.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended solution is to update the library to the fixed version.
Conclusion
The Google Closure Library versions up to and including v20200224 are vulnerable to an improper input validation issue in the goog.uri module. This can be exploited by attackers to manipulate URL parsing and potentially lead to security risks. To mitigate this vulnerability, it is crucial to update the library to version v20200315 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for google-closure-library →
FAQ
The Google Closure Library is a JavaScript library that provides utilities and classes for web application development.
The vulnerability can lead to security issues such as cross-site scripting (XSS) attacks or unauthorized access to sensitive resources.
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
To fix this vulnerability, update the Google Closure Library to version v20200315 or later.
No specific workaround is provided. Updating the library to the fixed version is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for google-closure-library.
