Medium severity · published Mar 30, 2023
CVE-2023-26116
Versions of the package angular from 1.2.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the angular.copy() utility function due to the usage of an insecure…
5.3
CVSS
1.7%
EPSS
No
On KEV
Description
Versions of the package angular from 1.2.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the angular.copy() utility function due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AN
Angularjs · Angularjs
1.2.21 through 1.8.3 · source: NVD
FE
Fedora · Fedoraproject
38 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-26116
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-26116
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OQWJLE5WE33WNMA54XSJIDXBRK2KL3XJ/
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UDKFLKJ6VZKL52AFVW2OVZRMJWHMW55K/
Exploit
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-5406320
Exploit
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-5406322
Exploit
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-5406321
Exploit
https://security.snyk.io/vuln/SNYK-JS-ANGULAR-3373044
More from Angularjs
7.5
CVE-2022-25844
The package angular after 1.7.0 are vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assign the parameter in…
7.5
CVE-2019-10768
In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload
6.1
CVE-2022-25869
All versions of the package angular; all versions of the package angularjs.core; all versions of the package angularjs are vulnerable to Cross-site Scripting (XSS) due to insecure…
6.1
CVE-2019-14863
There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of the web application, the web application delivers data to its users along…
5.4
CVE-2021-4231
A vulnerability was found in Angular up to 11.0.4/11.1.0-next.2