p PatchFirst

CVE-2024-8372

CVE-2024-8372 · AngularJS improper sanitization in 'srcset' attribute

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Improper sanitization of the value of the 'srcset' attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing . This issue affects AngularJS versions 1.3.0-rc.4 and greater. Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .

CVSS 4.8 · Medium · EPSS 0.6% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • angularjs

    Versions
    • >=1.3.0-rc.4: Affected (semver)

    No fix published

  • angular.js Debian:12

    Versions
    • 1.8.3-1
    • 1.8.3-1+deb12u1~deb11u1
    Affected ranges
    • ECOSYSTEM: < 1.8.3-1+deb12u1

    Update to 1.8.3-1+deb12u1

  • angular.js Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.8.3-2

    Update to 1.8.3-2

  • angular npm

    Affected ranges
    • SEMVER: ≥ 1.3.0-rc.4, ≤ 1.8.3

    No fix published

  • angular.js Ubuntu:Pro:18.04:LTS

    Versions
    • 1.5.10-1
    Affected ranges
    • ECOSYSTEM: < 1.5.10-1ubuntu0.1~esm1

    Update to 1.5.10-1ubuntu0.1~esm1

  • angular.js Ubuntu:Pro:20.04:LTS

    Versions
    • 1.5.10-1
    • 1.7.9-1
    Affected ranges
    • ECOSYSTEM: < 1.7.9-1ubuntu0.1~esm1

    Update to 1.7.9-1ubuntu0.1~esm1

  • angular.js Ubuntu:22.04:LTS

    Versions
    • 1.8.2-2
    Affected ranges
    • ECOSYSTEM: < 1.8.2-2ubuntu0.1

    Update to 1.8.2-2ubuntu0.1

  • angular.js Ubuntu:24.04:LTS

    Versions
    • 1.8.3-1
    Affected ranges
    • ECOSYSTEM: < 1.8.3-1ubuntu0.24.04.1

    Update to 1.8.3-1ubuntu0.24.04.1

Original sources

Check your server →