Vulnerability · Published Jun 8, 2020 · Assigned by snyk
CVE-2020-7676
Medium 5.4
In plain English
A medium-severity security flaw in angular.js. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)5.4Medium
Exploit odds (30 days)1.9%top 19.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
angular.js prior to 1.8.0 allows cross site scripting. The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping "<option>" elements in "<select>" ones changes parsing behavior, leading to possibly unsanitizing code.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | angular.js | 1.8.0-1 | DEBIAN-CVE-2020-7676 |
| Debian:13 | angular.js | 1.8.0-1 | DEBIAN-CVE-2020-7676 |
| npm | angular | 1.8.0 | GHSA-mhp6-pxh8-r675 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | angular.js | All versions prior to 1.8.0 |
References
- https://github.com/angular/angular.js/pull/17028%2C x_refsource_MISC
- https://snyk.io/vuln/SNYK-JS-ANGULAR-570058 x_refsource_MISC
- [nifi-commits] 20200930 svn commit: r1882168 - /nifi/site/trunk/security.html mailing-list, x_refsource_MLIST
- [hadoop-ozone-issues] 20201006 [jira] [Updated] (HDDS-4316) Upgrade to angular 1.8.0 due to CVE-2020-7676 mailing-list, x_refsource_MLIST
- [hadoop-ozone-issues] 20201006 [GitHub] [hadoop-ozone] vivekratnavel opened a new pull request #1481: HDDS-4316. Upgrade to angular 1.8.0 due to CVE-2020-7676 mailing-list, x_refsource_MLIST
- [hadoop-ozone-issues] 20201006 [jira] [Created] (HDDS-4316) Upgrade to angular 1.8.0 due to CVE-2020-7676 mailing-list, x_refsource_MLIST
- [hadoop-ozone-issues] 20201006 [GitHub] [hadoop-ozone] dineshchitlangia commented on a change in pull request #1481: HDDS-4316. Upgrade to angular 1.8.0 due to CVE-2020-7676 mailing-list, x_refsource_MLIST
- [hadoop-ozone-issues] 20201007 [GitHub] [hadoop-ozone] vivekratnavel commented on pull request #1481: HDDS-4316. Upgrade to angular 1.8.0 due to CVE-2020-7676 mailing-list, x_refsource_MLIST
- [hadoop-ozone-issues] 20201008 [jira] [Updated] (HDDS-4316) Upgrade to angular 1.8.0 due to CVE-2020-7676 mailing-list, x_refsource_MLIST
- [hadoop-ozone-commits] 20201008 [hadoop-ozone] branch master updated: HDDS-4316. Upgrade to angular 1.8.0 due to CVE-2020-7676 (#1481) mailing-list, x_refsource_MLIST
- [hadoop-ozone-issues] 20201008 [GitHub] [hadoop-ozone] adoroszlai merged pull request #1481: HDDS-4316. Upgrade to angular 1.8.0 due to CVE-2020-7676 mailing-list, x_refsource_MLIST
- [hadoop-ozone-issues] 20201009 [GitHub] [hadoop-ozone] adoroszlai merged pull request #1481: HDDS-4316. Upgrade to angular 1.8.0 due to CVE-2020-7676 mailing-list, x_refsource_MLIST