GHSA-c75v-2vq8-878f
Angular vulnerable to Cross-site Scripting
At a glance
- Published
- Updated
- CVE
- CVE-2021-4231
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Description
A vulnerability was found in Angular up to 11.0.4/11.1.0-next.2. It has been classified as problematic. Affected is the handling of comments. The manipulation leads to cross site scripting. It is possible to launch the attack remotely but it might require an authentication first. Upgrading to version 10.2.5, 11.0.5 or 11.1.0-next.3 is advised to to address this issue.
Affected packages
| Package | Versions |
|---|---|
| npm · @angular/core | introduced 11.0.0, fixed 11.0.5 |
| npm · @angular/core | introduced 11.1.0-next.0, fixed 11.1.0-next.3 |
| npm · @angular/core | introduced 0, fixed 10.2.5 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2021-4231 ADVISORY
- https://github.com/angular/angular/issues/40136 WEB
- https://github.com/angular/angular/commit/0aa220bc0000fc4d1651ec388975bbf5baa1da36 WEB
- https://github.com/angular/angular/commit/47d9b6d72dab9d60c96bc1c3604219f6385649ea WEB
- https://github.com/angular/angular/commit/ba8da742e3b243e8f43d4c63aa842b44e14f2b09 WEB
- https://github.com/angular/angular PACKAGE
- https://security.snyk.io/vuln/SNYK-JS-ANGULARCORE-1070902 WEB
- https://vuldb.com/?id.181356 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |