Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

angular-1.2.16.min.js: 7 vulnerabilities (highest severity is: 7.5) #2

Open
mend-bolt-for-github bot opened this issue Mar 2, 2024 · 0 comments
Open

angular-1.2.16.min.js: 7 vulnerabilities (highest severity is: 7.5) #2

mend-bolt-for-github bot opened this issue Mar 2, 2024 · 0 comments
Labels
Mend: dependency security vulnerability Security vulnerability detected by Mend

Comments

@mend-bolt-for-github
Copy link
Contributor

mend-bolt-for-github bot commented Mar 2, 2024 •
edited
Loading

Vulnerable Library - angular-1.2.16.min.js

AngularJS is an MVC framework for building web applications. The core features include HTML enhanced with custom component and data-binding capabilities, dependency injection and strong focus on simplicity, testability, maintainability and boiler-plate reduction.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.2.16/angular.min.js

Path to vulnerable library: /src/main/webapp/js/angular/angular.min.js

Found in HEAD commit: 8e77b396d668c29101fea052f4b32fd3ad16341f

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (angular version) Remediation Possible**
CVE-2019-10768 High 7.5 angular-1.2.16.min.js Direct angularjs - 1.7.9 ❌
CVE-2019-14863 Medium 6.1 angular-1.2.16.min.js Direct angular - v1.5.0-beta.1;org.webjars:angularjs:1.5.0-rc.0 ❌
CVE-2020-7676 Medium 5.4 angular-1.2.16.min.js Direct 1.8.0 ❌
CVE-2023-26118 Medium 5.3 angular-1.2.16.min.js Direct N/A ❌
CVE-2023-26117 Medium 5.3 angular-1.2.16.min.js Direct N/A ❌
CVE-2023-26116 Medium 5.3 angular-1.2.16.min.js Direct N/A ❌
CVE-2022-25869 Medium 4.2 angular-1.2.16.min.js Direct N/A ❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2019-10768

Vulnerable Library - angular-1.2.16.min.js

AngularJS is an MVC framework for building web applications. The core features include HTML enhanced with custom component and data-binding capabilities, dependency injection and strong focus on simplicity, testability, maintainability and boiler-plate reduction.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.2.16/angular.min.js

Path to vulnerable library: /src/main/webapp/js/angular/angular.min.js

Dependency Hierarchy:

  • ❌ angular-1.2.16.min.js (Vulnerable Library)

Found in HEAD commit: 8e77b396d668c29101fea052f4b32fd3ad16341f

Found in base branch: master

Vulnerability Details

In AngularJS before 1.7.9 the function merge() could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.
Mend Note: After conducting further research, Mend has determined that versions 1.4.0-beta.6 before 1.7.9 of angular are vulnerable to CVE-2019-10768. Converted from WS-2019-0367, on 2021-07-21.

Publish Date: 2019-11-19

URL: CVE-2019-10768

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-11-19

Fix Resolution: angularjs - 1.7.9

Step up your Open Source Security Game with Mend here

CVE-2019-14863

Vulnerable Library - angular-1.2.16.min.js

AngularJS is an MVC framework for building web applications. The core features include HTML enhanced with custom component and data-binding capabilities, dependency injection and strong focus on simplicity, testability, maintainability and boiler-plate reduction.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.2.16/angular.min.js

Path to vulnerable library: /src/main/webapp/js/angular/angular.min.js

Dependency Hierarchy:

  • ❌ angular-1.2.16.min.js (Vulnerable Library)

Found in HEAD commit: 8e77b396d668c29101fea052f4b32fd3ad16341f

Found in base branch: master

Vulnerability Details

There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it.

Publish Date: 2020-01-02

URL: CVE-2019-14863

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-01-02

Fix Resolution: angular - v1.5.0-beta.1;org.webjars:angularjs:1.5.0-rc.0

Step up your Open Source Security Game with Mend here

CVE-2020-7676

Vulnerable Library - angular-1.2.16.min.js

AngularJS is an MVC framework for building web applications. The core features include HTML enhanced with custom component and data-binding capabilities, dependency injection and strong focus on simplicity, testability, maintainability and boiler-plate reduction.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.2.16/angular.min.js

Path to vulnerable library: /src/main/webapp/js/angular/angular.min.js

Dependency Hierarchy:

  • ❌ angular-1.2.16.min.js (Vulnerable Library)

Found in HEAD commit: 8e77b396d668c29101fea052f4b32fd3ad16341f

Found in base branch: master

Vulnerability Details

angular.js prior to 1.8.0 allows cross site scripting. The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping "" elements in "" ones changes parsing behavior, leading to possibly unsanitizing code. Publish Date: 2020-06-08 URL: CVE-2020-7676 CVSS 3 Score Details (5.4) Base Score Metrics: Exploitability Metrics: Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: Required Scope: Changed Impact Metrics: Confidentiality Impact: Low Integrity Impact: Low Availability Impact: None For more information on CVSS3 Scores, click here. Suggested Fix Type: Upgrade version Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7676 Release Date: 2020-06-08 Fix Resolution: 1.8.0 Step up your Open Source Security Game with Mend here CVE-2023-26118 Vulnerable Library - angular-1.2.16.min.js AngularJS is an MVC framework for building web applications. The core features include HTML enhanced with custom component and data-binding capabilities, dependency injection and strong focus on simplicity, testability, maintainability and boiler-plate reduction. Library home page: https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.2.16/angular.min.js Path to vulnerable library: /src/main/webapp/js/angular/angular.min.js Dependency Hierarchy: :x: angular-1.2.16.min.js (Vulnerable Library) Found in HEAD commit: 8e77b39 Found in base branch: master Vulnerability Details Versions of the package angular from 1.4.9 are vulnerable to Regular Expression Denial of Service (ReDoS) via the element due to the usage of an insecure regular expression in the input[url] functionality. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.

Publish Date: 2023-03-30

URL: CVE-2023-26118

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

CVE-2023-26117

Vulnerable Library - angular-1.2.16.min.js

AngularJS is an MVC framework for building web applications. The core features include HTML enhanced with custom component and data-binding capabilities, dependency injection and strong focus on simplicity, testability, maintainability and boiler-plate reduction.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.2.16/angular.min.js

Path to vulnerable library: /src/main/webapp/js/angular/angular.min.js

Dependency Hierarchy:

  • ❌ angular-1.2.16.min.js (Vulnerable Library)

Found in HEAD commit: 8e77b396d668c29101fea052f4b32fd3ad16341f

Found in base branch: master

Vulnerability Details

Versions of the package angular from 1.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the $resource service due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.

Publish Date: 2023-03-30

URL: CVE-2023-26117

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

CVE-2023-26116

Vulnerable Library - angular-1.2.16.min.js

AngularJS is an MVC framework for building web applications. The core features include HTML enhanced with custom component and data-binding capabilities, dependency injection and strong focus on simplicity, testability, maintainability and boiler-plate reduction.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.2.16/angular.min.js

Path to vulnerable library: /src/main/webapp/js/angular/angular.min.js

Dependency Hierarchy:

  • ❌ angular-1.2.16.min.js (Vulnerable Library)

Found in HEAD commit: 8e77b396d668c29101fea052f4b32fd3ad16341f

Found in base branch: master

Vulnerability Details

Versions of the package angular from 1.2.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the angular.copy() utility function due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.

Publish Date: 2023-03-30

URL: CVE-2023-26116

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

CVE-2022-25869

Vulnerable Library - angular-1.2.16.min.js

AngularJS is an MVC framework for building web applications. The core features include HTML enhanced with custom component and data-binding capabilities, dependency injection and strong focus on simplicity, testability, maintainability and boiler-plate reduction.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.2.16/angular.min.js

Path to vulnerable library: /src/main/webapp/js/angular/angular.min.js

Dependency Hierarchy:

  • ❌ angular-1.2.16.min.js (Vulnerable Library)

Found in HEAD commit: 8e77b396d668c29101fea052f4b32fd3ad16341f

Found in base branch: master

Vulnerability Details

All versions of package angular are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of <textarea> elements.

Publish Date: 2022-07-15

URL: CVE-2022-25869

CVSS 3 Score Details (4.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here
@mend-bolt-for-github mend-bolt-for-github bot added the Mend: dependency security vulnerability Security vulnerability detected by Mend label Mar 2, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Mend: dependency security vulnerability Security vulnerability detected by Mend
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
0 participants