En bref
- CVE-2022-25844 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant angularjs (angularjs), angular.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 4.9%, plus élevée que 92.1% des vulnérabilités.
- Aucune version corrigée n'est encore connue : suivez l'avis de l'éditeur dans les références.
| Package | Affected versions | Patched versions |
|---|
| angularjs | ≥ 1.7.0
| No fix yet |
| angular npm | ≥ 1.7.0
| No fix yet |
Description
AngularJS lets users write client-side web applications. The package angular after 1.7.0 is vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assign the parameter in posPre: ' '.repeat() of NUMBER_FORMATS.PATTERNS[1].posPre with a very high value.
Note:
- This package has been deprecated and is no longer maintained.
- The vulnerable versions are 1.7.0 and higher.
NVD description
The package angular after 1.7.0 are vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assign the parameter in posPre: ' '.repeat() of NUMBER_FORMATS.PATTERNS[1].posPre with a very high value. **Note:** 1) This package has been deprecated and is no longer maintained. 2) The vulnerable versions are 1.7.0 and higher.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free