Quick answers
- Is CVE-2020-5219 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2020-5219 being exploited in the wild.
- How severe is CVE-2020-5219?
- Low severity, with a CVSS score of 3.1, published 24 January 2020.
- Which products and versions are affected?
- Peerigon Angular-Expressions < 1.0.1.
- Is there a fix for CVE-2020-5219?
- A patch was published on 2020-01-24: Version 1.0.1 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2020-5219 attacked?
- It is attacked over the network.
- Am I affected by CVE-2020-5219?
- Check whether you run Peerigon Angular-Expressions at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a code injection flaw (CWE-74) in the angular-expressions library's expression compiler. When user-controlled input is passed directly to the expressions.compile() function, the parser fails to properly sanitize or validate the input, allowing attackers to inject arbitrary JavaScript expressions. The attack requires the application code to call compile() on untrusted data; no authentication is required, but user interaction (or application-level input handling) is necessary. An attacker can achieve arbitrary code execution. The vulnerability affects all versions prior to 1.0.1; users should upgrade immediately.
Affected products
- Peerigon angular-expressions < 1.0.1
Identifiers
- CVE-2020-5219
- GHSA-hxhm-96pp-2m43
Timeline
- 2020-01-24: disclosed
- 2020-01-24: patched: Version 1.0.1 released with fix