CVE-2024-8372

Severity

43%

Complexity

27%

Confidentiality

23%

Improper sanitization of the value of the '[srcset]' attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing . This issue affects AngularJS versions 1.3.0-rc.4 and greater. Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .

CVSS 3.1 Base Score 4.3. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N).

Overview

Type

AngularJS 1.3.0 Release Candidate

First reported 5 months ago

2024-09-09 15:15:00

Last updated 3 months ago

2024-11-22 12:15:00

Affected Software

AngularJS 1.3.0 Release Candidate 5

1.3.0

AngularJS 1.3.0 Release Candidate 4

1.3.0

References

https://www.herodevs.com/vulnerability-directory/cve-2024-8372

https://codepen.io/herodevs/full/xxoQRNL/0072e627abe03e9cda373bc75b4c1017

https://www.herodevs.com/vulnerability-directory/cve-2024-8372

Exploit, Third Party Advisory

https://codepen.io/herodevs/full/xxoQRNL/0072e627abe03e9cda373bc75b4c1017

Exploit, Third Party Advisory

https://security.netapp.com/advisory/ntap-20241122-0002/

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.