CVE-2024-8372

216.73.216.233

· Published 09/09/2024 15:15 · Modified 17/09/2024 17:24

Labels: CVE-2024-8372 2024-09-09 36c7be3b-2937-45df-85ea-ca7133ea542c CVE-2024-8372 CWE-1289 NVD-CWE-Other

Essential information

Published: 09/09/2024 15:15
Modified: 17/09/2024 17:24
Author: —
Creator: —
CVSS: 4.3 MEDIUM (v3.1)
CISA KEV: No
CWE: —
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CVSS metrics

Description

Improper sanitization of the value of the '[srcset]' attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing . This issue affects AngularJS versions 1.3.0-rc.4 and greater. Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .

NVD status

Status: Analyzed — CVE has been recently published to the CVE List and has been received by the NVD.
Source: 36c7be3b-2937-45df-85ea-ca7133ea542c
NVD: View on NVD

Affected products (CPE)

Product	CPE
angularjs / angular.js	`cpe:2.3:a:angularjs:angular.js::::::::`
angularjs / angular.js	`cpe:2.3:a:angularjs:angular.js:1.3.0:rc4::::::`
angularjs / angular.js	`cpe:2.3:a:angularjs:angular.js:1.3.0:rc5::::::`