Quick answers
- Is CVE-2022-25869 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2022-25869 being exploited in the wild.
- How severe is CVE-2022-25869?
- Low severity, with a CVSS score of 3.1, published 16 July 2022.
- Which products and versions are affected?
- angular (npm) SEMVER:introduced=0,last_affected=1.8.3.
- Is there a fix for CVE-2022-25869?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2022-25869 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2022-25869?
- Check whether you run angular (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a Cross-site Scripting (CWE-79) vulnerability in the deprecated npm package 'angular' affecting all versions through 1.8.3. The vulnerability stems from insecure page caching behavior in Internet Explorer, where textarea elements can be interpolated with unescaped user-controlled content. An attacker can craft malicious HTML containing textarea tags that, when cached by IE and subsequently processed by Angular, execute arbitrary JavaScript in the victim's browser context. User interaction (visiting a malicious page) is required. The vulnerability does not affect the actively maintained @angular/core package; users should migrate away from the deprecated 'angular' package.
Affected products
- Angular angular through 1.8.3
Identifiers
- CVE-2022-25869
- GHSA-prc3-vjfx-vhm9
Timeline
- 2022-07-15: disclosed
- 2022-07-16: advisory