Quick answers
- Is CVE-2024-8373 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2024-8373 being exploited in the wild.
- How severe is CVE-2024-8373?
- Low severity, with a CVSS score of 3.1, published 9 September 2024.
- Which products and versions are affected?
- angular (npm) SEMVER:introduced=0,last_affected=1.8.3.
- Is there a fix for CVE-2024-8373?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2024-8373 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2024-8373?
- Check whether you run angular (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a content spoofing issue (CWE-791) resulting from improper sanitization of the srcset attribute in <source> HTML elements within AngularJS. The framework fails to properly validate or escape srcset values, allowing attackers to craft malicious HTML that bypasses common Content Security Policy (CSP) restrictions on image sources. The attack requires no authentication or user interaction and is network-reachable. An attacker can inject arbitrary image sources or URLs, leading to unauthorized image loading and potential content spoofing attacks. This vulnerability affects all versions of AngularJS up to and including 1.8.3; however, AngularJS is end-of-life and will not receive patches.
Affected products
- Google AngularJS All versions up to and including 1.8.3
Identifiers
- CVE-2024-8373
- GHSA-mqm9-c95h-x2p6
Timeline
- 2024-09-09: disclosed: Published as GHSA-mqm9-c95h-x2p6 / CVE-2024-8373
- 2024-09-09: other: NVD published