Improper sanitization of the value of the 'srcset' attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing .
This issue affects AngularJS versions 1.3.0-rc.4 and greater.
Note:
The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .
References
| Link | Resource |
|---|---|
| https://codepen.io/herodevs/full/xxoQRNL/0072e627abe03e9cda373bc75b4c1017 | Exploit Third Party Advisory |
| https://www.herodevs.com/vulnerability-directory/cve-2024-8372 | Exploit Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20241122-0002/ | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
28 Apr 2025, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) Improper sanitization of the value of the 'srcset' attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing . This issue affects AngularJS versions 1.3.0-rc.4 and greater. Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status . |
12 Feb 2025, 20:14
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Netapp
Netapp active Iq Unified Manager |
|
| References | () https://security.netapp.com/advisory/ntap-20241122-0002/ - Third Party Advisory | |
| CPE | cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:* cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* |
22 Nov 2024, 12:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.8 |
| References |
|
17 Sep 2024, 17:24
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Angularjs
Angularjs angular.js |
|
| CWE | NVD-CWE-Other | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.3 |
| References | () https://codepen.io/herodevs/full/xxoQRNL/0072e627abe03e9cda373bc75b4c1017 - Exploit, Third Party Advisory | |
| References | () https://www.herodevs.com/vulnerability-directory/cve-2024-8372 - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:a:angularjs:angular.js:1.3.0:rc5:*:*:*:*:*:* cpe:2.3:a:angularjs:angular.js:1.3.0:rc4:*:*:*:*:*:* cpe:2.3:a:angularjs:angular.js:*:*:*:*:*:*:*:* |
09 Sep 2024, 18:30
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-09-09 15:15
Updated : 2025-04-28 14:15
NVD link : CVE-2024-8372
Mitre link : CVE-2024-8372
CVE.ORG link : CVE-2024-8372
JSON object : View
Products Affected
angularjs
- angular.js
netapp
- active_iq_unified_manager
CWE