Is CVE-2019-14863 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2019-14863 being exploited in the wild.

How severe is CVE-2019-14863?

Low severity, with a CVSS score of 3.1, published 14 February 2020.

Which products and versions are affected?

angular (npm) SEMVER:introduced=0,fixed=1.5.0-beta.1.

Is there a fix for CVE-2019-14863?

Yes. angular (npm): upgrade to 1.5.0-beta.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2019-14863 attacked?

It is attacked over the network.

Am I affected by CVE-2019-14863?

Check whether you run angular (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-14863: AngularJS cross-site scripting in xlink:href sanitization

CVE-2019-14863 · Severity: low · CVSS 3.1 · Published 2020-02-14

AngularJS is a popular JavaScript framework used to build dynamic web applications. The framework failed to properly sanitize SVG xlink:href attributes, allowing attackers to inject and execute malicious JavaScript code in users' browsers if they interact with a page containing user-controlled SVG attributes. This could lead to account compromise, credential theft, or redirection to malicious sites.

Technologies: angular (npm). Vendors: npm.

Quick answers

Is CVE-2019-14863 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2019-14863 being exploited in the wild.
How severe is CVE-2019-14863?: Low severity, with a CVSS score of 3.1, published 14 February 2020.
Which products and versions are affected?: angular (npm) SEMVER:introduced=0,fixed=1.5.0-beta.1.
Is there a fix for CVE-2019-14863?: Yes. angular (npm): upgrade to 1.5.0-beta.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2019-14863 attacked?: It is attacked over the network.
Am I affected by CVE-2019-14863?: Check whether you run angular (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

angular (npm): upgrade to 1.5.0-beta.1 or later
```
npm install angular@1.5.0-beta.1
```

Technical details

This is a cross-site scripting (XSS) vulnerability (CWE-79) in AngularJS's HTML sanitization routines. The framework's sanitizer failed to properly validate and escape xlink:href attributes in SVG elements, a common vector for injecting JavaScript protocol handlers. The vulnerability requires user interaction (victim must click or interact with the malicious SVG element) and the xlink:href value must be user-controlled or attacker-influenced. An attacker can craft a malicious SVG document that, when rendered by a vulnerable AngularJS application, executes arbitrary JavaScript with the privileges of the authenticated user. The fix is available in AngularJS version 1.5.0-beta.1 and later.

Affected products

AngularJS AngularJS prior to 1.5.0-beta.1

Identifiers

CVE-2019-14863
GHSA-r5fx-8r73-v86c

Timeline

2020-02-14: disclosed
2015-08-07: patched: Fix merged in PR #12524

References

https://github.com/angular/angular.js/pull/12524

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.