CVE-2021-22568 log

Source
Severity Medium
Remote Yes
Type Authentication bypass
Description
A security issue has been found in Dart before version 2.15.0. When using the dart pub publish command to publish a package to a third-party package server, the request would be authenticated with an oauth2 access_token that is valid for publishing on pub.dev. Using these obtained credentials, an attacker can impersonate the user on pub.dev.
Group Package Affected Fixed Severity Status Ticket
AVG-2618 dart 2.14.4-1 Medium Vulnerable
References
https://github.com/dart-lang/sdk/security/advisories/GHSA-r32f-vhjp-qhj7
https://github.com/dart-lang/pub/pull/3007
https://github.com/dart-lang/pub/commit/bbdac802eb27ab8aa2af6732f739e0b51561d718#diff-5fea24e813d36f3b0e47536ee2c1d5779d54bfd0991e693577b7e8a9fd7f141cR145-R183
https://github.com/dart-lang/sdk/commit/d787e78d21e12ec1ef712d229940b1172aafcdf8