GHSA-C75V-2VQ8-878F Angular vulnerable to Cross-site Scripting

A vulnerability was found in Angular up to 11.0.4/11.1.0-next.2. It has been classified as problematic. Affected is the handling of comments. The manipulation leads to cross site scripting. It is possible to launch the attack remotely but it might require an authentication first. Upgrading to...

Cross site scripting in Angular

A vulnerability was found in Angular up to 11.0.4/11.1.0-next.2. It has been classified as problematic. Affected is the handling of comments. The manipulation leads to cross site scripting. It is possible to launch the attack remotely but it might require an authentication first. Upgrading to...

CVE-2021-4231

A vulnerability was found in Angular up to 11.0.4/11.1.0-next.2. It has been classified as problematic. Affected is the handling of comments. The manipulation leads to cross site scripting. It is possible to launch the attack remotely but it might require an authentication first. Upgrading to...

Cross site scripting

A vulnerability was found in Angular up to 11.0.4/11.1.0-next.2. It has been classified as problematic. Affected is the handling of comments. The manipulation leads to cross site scripting. It is possible to launch the attack remotely but it might require an authentication first. Upgrading to...

@amicus/auth (>=1.0.3, <=1.1.5), @amicus/broadcasting (>=1.0.3, <=1.1.5) +446 more potentially affected by CVE-2021-4231 via @angular/platform-browser-dynamic (>=4.0.0, <=4.4.6)

@angular/platform-browser-dynamic NPM version =4.0.0, =1.0.3, =1.0.3, =1.0.3, =1.1.1, =2.8.2, =3.0.0-beta.45, =1.32.0-SNAPSHOT.20171018190510, =1.0.0, =0.0.64, =1.10.0, =2.0.0-rc.2, =1.10.1, =2.0.0-beta.8, =1.0.1, =0.2.1, =0.3.4 and more Source cves: CVE-2021-4231 Source advisory: MEND:CVE-2021-4...

@afelio/sprb-osiris-uikit (1.0.48), @alfresco/adf-content-services (>=2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, <=2.5.0-ffef7688d7d5b9a2827d4427d416d0b5b2f377d4) +202 more potentially affected by CVE-2021-4231 via @angular/animations (>=5.0.0, <=5.2.10)

@angular/animations NPM version =5.0.0, =2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, =2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, =2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, =2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, =0.0.2, =1.0.0-beta.1, =2.23.1, =0.1.6, =3.0.0, =0.0.54,...

@abt-desk/apm (>=0.0.1, <=0.33.12), @abt-desk/rsc (>=0.1.3, <=0.1.124) +458 more potentially affected by CVE-2021-4231 via @angular/platform-browser-dynamic (>=7.0.0, <=7.2.14)

@angular/platform-browser-dynamic NPM version =7.0.0, =0.0.1, =0.1.3, =1.0.0, =2.0.0, =9.25.1, =1.0.2-1.beta.1, =0.0.1, =0.0.1, =0.0.1, =0.6.5 and more Source cves: CVE-2021-4231 Source advisory: MEND:CVE-2021-4231...

CVE-2021-4231

The CVE-2021-4231 entry corresponds to an Angular XSS vulnerability in the Angular versions up to 11.0.4 and 11.1.0-next.2, specifically affecting the handling of comments, where input could be crafted to execute script in a victim’s browser when rendering. The upstream patch fixes this by upgrad...

@acaisoft/angular-azure-maps (>=0.0.3, <=0.0.11), @afelio/sprb-osiris-uikit (1.0.48) +266 more potentially affected by CVE-2021-4231 via @angular/http (>=5.0.0, <=5.2.10)

@angular/http NPM version =5.0.0, =0.0.3, =2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, =2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, =2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, =2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, =0.0.2, =1.0.0-beta.1, =0.1.15, =1.0.0-alpha.55, =0.1.6,...

@amicus/auth (>=1.0.3, <=1.1.5), @amicus/broadcasting (>=1.0.3, <=1.1.5) +286 more potentially affected by CVE-2021-4231 via @angular/animations (>=4.0.0, <=4.4.6)

@angular/animations NPM version =4.0.0, =1.0.3, =1.0.3, =1.0.3, =1.1.1, =3.0.0-beta.45, =0.0.64, =1.10.0, =2.0.0-rc.2, =1.10.1, =2.0.0-beta.8, =0.2.1, =0.2.1, =0.2.1, =0.2.1, =0.2.81 and more Source cves: CVE-2021-4231 Source advisory: MEND:CVE-2021-4231...

@hyperledger/cactus-cockpit (0.3.0), @kengic/ng.account (>=3.2.100, <=3.3.127) +16 more potentially affected by CVE-2021-4231 via @angular/core (>=11.0.0, <=11.0.4)

@angular/core NPM version =11.0.0, =3.2.100, =3.2.106, =3.2.100, =1.0.100, =1.0.1-BETA.93934, =1.0.0-BETA.93934, =1.0.59, =1.1.61, =1.0.2, =0.0.2, =0.0.3 - gs-angular-library 0.0.0 and more Source cves: CVE-2021-4231 Source advisory: MEND:CVE-2021-4231...

@actra-development-oss/ng-i18n-aot-loader (>=1.0.2, <=1.0.4), @amicus/auth (>=1.0.3, <=1.1.5) +484 more potentially affected by CVE-2021-4231 via @angular/compiler (>=4.0.0, <=4.4.6)

@angular/compiler NPM version =4.0.0, =1.0.2, =1.0.3, =1.0.3, =1.0.3, =1.1.1, =2.8.2, =3.0.0-beta.45, =1.32.0-SNAPSHOT.20171018190510, =0.0.0, =1.0.0, =0.0.64, =1.10.0, =2.0.0-rc.2, =1.10.1, =2.0.0-beta.8, =2.0.0-beta.9 and more Source cves: CVE-2021-4231 Source advisory: MEND:CVE-2021-4231...

@c8y/apps (>=9.25.1, <=1005.8.0), cmf.angular (2.0.0-71817) +2 more potentially affected by CVE-2021-4231 via @angular/upgrade (>=7.0.0, <=7.2.13)

@angular/upgrade NPM version =7.0.0, =9.25.1, =0.5.5, =2.0.0-beta.1, =2.0.0-beta.2 Source cves: CVE-2021-4231 Source advisory: MEND:CVE-2021-4231...

@altariotechnologieslisbon/seed-pro (>=0.0.1, <=0.1.0), @bi8/am-data-table (>=8.0.0, <=8.0.2) +467 more potentially affected by CVE-2021-4231 via @angular/platform-browser (>=8.0.0, <=8.2.13)

@angular/platform-browser NPM version =8.0.0, =0.0.1, =8.0.0, =8.0.0, =1.0.0, =1005.9.0, =8.0.2, =7.0.0-internal-20190531-1650, =1.0.6, =1.0.30 and more Source cves: CVE-2021-4231 Source advisory: MEND:CVE-2021-4231...

@arsedizioni/ars-utils (>=1.0.0, <=1.0.3), @astick/astick-ng (1.0.0) +240 more potentially affected by CVE-2021-4231 via @angular/animations (>=9.0.0, <=9.1.12)

@angular/animations NPM version =9.0.0, =1.0.0, =3.0.0, =0.0.1, =0.0.3, =0.0.1, =5.1.4, =1.0.0, =9.0.0, =9.0.5 and more Source cves: CVE-2021-4231 Source advisory: MEND:CVE-2021-4231...

@mxtommy/kip (>=1.1.1, <=1.1.2), angular-nest-starter (0.1.0) +4 more potentially affected by CVE-2021-4231 via @angular/platform-server (>=9.0.0, <=9.1.11)

@angular/platform-server NPM version =9.0.0, =1.1.1, =0.0.0, =0.0.1 - jio-digiapi-auto-mate-plus-ui-app 1.2.0 - node-angular-app-template 0.0.1 - shared-encoding-library 0.0.0 Source cves: CVE-2021-4231 Source advisory: MEND:CVE-2021-4231...

@arsedizioni/ars-utils (>=1.0.0, <=1.0.3), @astick/astick-ng (1.0.0) +256 more potentially affected by CVE-2021-4231 via @angular/platform-browser-dynamic (>=9.0.0, <=9.1.12)

@angular/platform-browser-dynamic NPM version =9.0.0, =1.0.0, =3.0.0, =1.0.0, =1.0.0, =0.0.1, =0.0.3, =0.0.1, =5.1.4, =1.0.0, =1.0.1 and more Source cves: CVE-2021-4231 Source advisory: MEND:CVE-2021-4231...

@2aminternal/ngx-table-view (>=1.0.1, <=1.0.6), @acaisoft/angular-azure-maps (>=0.0.12, <=1.0.0) +177 more potentially affected by CVE-2021-4231 via @angular/http (>=6.0.0, <=6.1.9)

@angular/http NPM version =6.0.0, =1.0.1, =0.0.12, =1.0.0, =0.0.7, =6.0.1, =6.0.0, =9.16.1-rc.0, =1.1.0, =5.0.0-beta.1, =0.0.1, =2.0.0, =2.0.1 - @golden-codes/core 2.0.0 and more Source cves: CVE-2021-4231 Source advisory: MEND:CVE-2021-4231...

@abt-desk/apm (>=0.0.1, <=0.33.12), @abt-desk/rsc (>=0.1.3, <=0.1.124) +443 more potentially affected by CVE-2021-4231 via @angular/router (>=7.0.0, <=7.2.14)

@angular/router NPM version =7.0.0, =0.0.1, =0.1.3, =2.0.0, =9.25.1, =0.0.1, =0.0.1, =0.0.1, =0.0.3, =0.0.2, =0.2.2 and more Source cves: CVE-2021-4231 Source advisory: MEND:CVE-2021-4231...

@acaisoft/angular-azure-maps (>=0.0.12, <=1.0.0), @angular-materials/ngx-admin (>=1.0.0, <=1.0.1) +199 more potentially affected by CVE-2021-4231 via @angular/forms (>=6.0.0, <=6.1.9)

@angular/forms NPM version =6.0.0, =0.0.12, =1.0.0, =6.0.1, =6.0.0, =9.16.1-rc.0, =1.1.0, =5.0.0-beta.1, =0.0.5, =0.0.1, =2.0.0, =2.0.1 - @golden-codes/core 2.0.0 and more Source cves: CVE-2021-4231 Source advisory: MEND:CVE-2021-4231...