Log in Start free

Vulnerability · Published Jul 15, 2022 · Assigned by snyk

CVE-2022-25869

Medium 4.2

In plain English

A medium-severity cross-site scripting in angular. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 7.7% (higher than 95% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)4.2Medium
Exploit odds (30 days)7.7%top 5.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC

Official description

All versions of the package angular; all versions of the package angularjs.core; all versions of the package angularjs are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of <textarea> elements.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12angular.jsno fix listedDEBIAN-CVE-2022-25869
Debian:13angular.jsno fix listedDEBIAN-CVE-2022-25869
Ubuntu:22.04:LTSangular.jsno fix listedUBUNTU-CVE-2022-25869
Ubuntu:24.04:LTSangular.jsno fix listedUBUNTU-CVE-2022-25869
Ubuntu:25.10angular.jsno fix listedUBUNTU-CVE-2022-25869
Ubuntu:26.04:LTSangular.jsno fix listedUBUNTU-CVE-2022-25869
Ubuntu:26.10angular.jsno fix listedUBUNTU-CVE-2022-25869
npmangularno fix listedGHSA-prc3-vjfx-vhm9

Affected products (as reported)

VendorProductVersions
n/a angular 0 – before *
n/a org.webjars.npm:angular 0 – before *
n/a org.webjars.bower:angular 0 – before *
n/a org.webjars.bowergithub.angular:angular 0 – before *
n/a AngularJS.Core 0 – before *
n/a angularjs 0 – before *

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P

References