PT-2024-38977

CVE-2024-8372

Published

2024-05-21

Updated

2026-08-04

Description by

CVSS 3.1

4.8

Medium

MetricsAV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions: AngularJS versions 1.3.0-rc.4 and greater

Description: The issue is due to improper sanitization of the value of the [srcset] attribute in AngularJS, allowing attackers to bypass common image source restrictions. This can lead to a form of Content Spoofing. The AngularJS project is End-of-Life and will not receive any updates to address this issue.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

George Kalpakas

Vendors

Affected products

Weakness enumeration

CWE-1289: Improper Validation of Unsafe Equivalence in Input

Related identifiers

CVE-2024-8372