In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload.

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the K000141463 advisory.

    CVE-2019-10768In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying     properties of `Object.prototype` using a `__proto__` payload.CVE-2023-26116Versions of the package angular     from 1.2.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the angular.copy() utility     function due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by     a large carefully-crafted input, which can result in catastrophic backtracking.CVE-2023-26117Versions of     the package angular from 1.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the     $resource service due to the usage of an insecure regular expression. Exploiting this vulnerability is     possible by a large carefully-crafted input, which can result in catastrophic     backtracking.CVE-2023-26118Versions of the package angular from 1.4.9 are vulnerable to Regular Expression     Denial of Service (ReDoS) via the <input type=url> element due to the usage of an insecure regular     expression in the input[url] functionality. Exploiting this vulnerability is possible by a large     carefully-crafted input, which can result in catastrophic backtracking.

Tenable has extracted the preceding description block directly from the F5 Networks BIG-IP security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:0274 advisory.

    Angular JavaScript library packaged for setuptools (easy_install) / pip.

    Security Fix(es):

    * Prototype pollution in merge function could result in code injection     (CVE-2019-10768)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8866 advisory.

    Angular JavaScript library packaged for setuptools (easy_install) / pip.

    Security Fix(es):

    * Prototype pollution in merge function could result in code injection     (CVE-2019-10768)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8849 advisory.

    Angular JavaScript library packaged for setuptools (easy_install) / pip.

    Security Fix(es):

    * Prototype pollution in merge function could result in code injection     (CVE-2019-10768)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, AngularJS is prior to 1.7.9. Therefore, it may be affected by a prototype pollution vulnerability through merge() function.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
209061	F5 Networks BIG-IP : Multiple Angular JS vulnerabilities (K000141463)	Nessus	F5 Networks Local Security Checks	high
194194	RHEL 9 : Red Hat OpenStack Platform 17.0 (python-XStatic-Angular) (RHSA-2023:0274)	Nessus	Red Hat Local Security Checks	high
170381	RHEL 8 : Red Hat OpenStack Platform 16.1.9 (python-XStatic-Angular) (RHSA-2022:8866)	Nessus	Red Hat Local Security Checks	high
170364	RHEL 8 : Red Hat OpenStack Platform 16.2.4 (python-XStatic-Angular) (RHSA-2022:8849)	Nessus	Red Hat Local Security Checks	high
112699	AngularJS < 1.7.9 Prototype Pollution	Web App Scanning	Component Vulnerability	high

Detections

Analytics

CVE-2019-10768

high

Tenable Plugins

high

high

high

high

high