Fluid Attacks Database

Description

Angular (deprecated package) Cross-site Scripting All versions of package angular are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of <textarea> elements.

NPM package angular is deprecated. Those who want to receive security updates should use the actively maintained package @angular/core.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version
npm	angular	>=0 <=1.8.3
debian 11	angular.js	=1.8.2-2 \|\| =1.8.3-1 \|\| =1.8.3-2 \|\| =1.8.3-3
debian 12	angular.js	=1.8.3-1 \|\| =1.8.3-1+deb12u1 \|\| =1.8.3-1+deb12u1~deb11u1 \|\| =1.8.3-2 \|\| =1.8.3-3
debian 13	angular.js	=1.8.3-3

Aliases

1. CVE-2022-258692. NVD-2022-258693. OSV-2022-258694. OSV-DEBIAN-2022-258695. GCVE-2022-258696. SECURITY-TRACKER-CVE-2022-25869

References

1. https://glitch.com/edit/%23%21/angular-repro-textarea-xss2. https://neverendingsupport.github.io/angularjs-poc-cve-2022-258693. https://github.com/neverendingsupport/angularjs-poc-cve-2022-25869

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.