CVE-2022-25869

medium

Description

All versions of package angular are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of <textarea> elements.

References

https://snyk.io/vuln/SNYK-JS-ANGULAR-2949781

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2949782

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-2949784

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2949783

https://glitch.com/edit/%23%21/angular-repro-textarea-xss

Details

Source: Mitre, NVD

Published: 2022-07-15

Updated: 2022-07-21

Risk Information

CVSS v2

Base Score: 6.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 6.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N