CVE-2022-25869 (Medium) detected in multiple libraries

[mend-bolt-for-github]

CVE-2022-25869 - Medium Severity Vulnerability

Vulnerable Libraries - angular-1.0.0rc5.js, angular-1.0.0rc4.js, angular-1.2.16.js, angular-1.8.2.jar

angular-1.0.0rc5.js

AngularJS is an MVC framework for building web applications. The core features include HTML enhanced with custom component and data-binding capabilities, dependency injection and strong focus on simplicity, testability, maintainability and boiler-plate reduction.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.0.0rc5/angular.js

Path to vulnerable library: /src/main/resources/static/components/angular-ui/test/lib/angular/angular-1.0.0rc5.js

Dependency Hierarchy:

• ❌ angular-1.0.0rc5.js (Vulnerable Library)

angular-1.0.0rc4.js

AngularJS is an MVC framework for building web applications. The core features include HTML enhanced with custom component and data-binding capabilities, dependency injection and strong focus on simplicity, testability, maintainability and boiler-plate reduction.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.0.0rc4/angular.js

Path to vulnerable library: /src/main/resources/static/components/angular-ui/test/lib/angular/angular-1.0.0rc4.js

Dependency Hierarchy:

• ❌ angular-1.0.0rc4.js (Vulnerable Library)

angular-1.2.16.js

AngularJS is an MVC framework for building web applications. The core features include HTML enhanced with custom component and data-binding capabilities, dependency injection and strong focus on simplicity, testability, maintainability and boiler-plate reduction.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.2.16/angular.js

Path to dependency file: /src/main/resources/static/components/angular-ui-bootstrap/src/position/test/test.html

Path to vulnerable library: /src/main/resources/static/components/angular-ui-bootstrap/misc/test-lib/angular.js,/src/main/resources/static/components/angular-ui-bootstrap/src/position/test/../../../misc/test-lib/angular.js

Dependency Hierarchy:

• ❌ angular-1.2.16.js (Vulnerable Library)

angular-1.8.2.jar

WebJar for angular

Library home page: https://www.webjars.org

Path to dependency file: /pom.xml

Path to vulnerable library: /pom.xml

Dependency Hierarchy:

• ❌ angular-1.8.2.jar (Vulnerable Library)

Found in HEAD commit: f98a7663cd4534d7282b786a5f475d4e4b48c1c7

Found in base branch: master

Vulnerability Details

All versions of package angular are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of <textarea> elements.

Publish Date: 2022-07-15

URL: CVE-2022-25869

CVSS 3 Score Details (4.2)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

---

Step up your Open Source Security Game with Mend here