CVE-2024-8372

Description

Improper sanitization of the value of the '[srcset]' attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing . This issue affects AngularJS versions 1.3.0-rc.4 and greater. Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .

Reserved 2024-09-02 | Published 2024-09-09 | Updated 2024-11-22 | Assigner HeroDevs

Problem types

CWE-1289: Improper Validation of Unsafe Equivalence in Input

Product status

Default status
unaffected

1.3.0-rc.4 before *
affected

References

www.herodevs.com/vulnerability-directory/cve-2024-8372 third-party-advisory

codepen.io/.../full/xxoQRNL/0072e627abe03e9cda373bc75b4c1017 technical-description exploit

cve.org (CVE-2024-8372)

nvd.nist.gov (CVE-2024-8372)

Download JSON