Vulnerability · Published May 26, 2022 · Assigned by VulDB
CVE-2021-4231Angular Comment cross site scripting
Low 3.5
In plain English
A low-severity cross-site scripting in Angular from unspecified. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A vulnerability was found in Angular up to 11.0.4/11.1.0-next.2. It has been classified as problematic. Affected is the handling of comments. The manipulation leads to cross site scripting. It is possible to launch the attack remotely but it might require an authentication first. Upgrading to version 11.0.5 and 11.1.0-next.3 is able to address this issue. The name of the patch is ba8da742e3b243e8f43d4c63aa842b44e14f2b09. It is recommended to upgrade the affected component.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @angular/core | 11.0.5 | GHSA-c75v-2vq8-878f |
| npm | @angular/core | 11.1.0-next.3 | GHSA-c75v-2vq8-878f |
| npm | @angular/core | 10.2.5 | GHSA-c75v-2vq8-878f |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| unspecified | Angular | 11.0.011.0.111.0.211.0.311.0.411.1.0-next.011.1.0-next.111.1.0-next.2 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
References
- https://github.com/angular/angular/issues/40136 x_refsource_MISC
- https://github.com/angular/angular/commit/ba8da742e3b243e8f43d4c63aa842b44e14f2b09 x_refsource_MISC
- https://security.snyk.io/vuln/SNYK-JS-ANGULARCORE-1070902 x_refsource_MISC
- https://vuldb.com/?id.181356 x_refsource_MISC