PT-2024-38978

CVE-2024-8373

Published

2024-05-21

Updated

2026-08-04

Description by

CVSS 3.1

4.8

Medium

MetricsAV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions: AngularJS versions all

Description: The issue is related to improper sanitization of the value of the [srcset] attribute in <source> HTML elements in AngularJS, allowing attackers to bypass common image source restrictions. This can also lead to a form of Content Spoofing. The AngularJS project is End-of-Life and will not receive any updates to address this issue.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

George Kalpakas

Vendors

Affected products

Weakness enumeration

CWE-791: Incomplete Filtering of Special Elements

Related identifiers

CVE-2024-8373