CVE-2024-8372

Katalog CVE

CVSS 4.3 · Medium EPSS 0,61%

Kerentanan Improper Validation of Unsafe Equivalence in Input pada angularjs, netapp active iq unified manager. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

Improper sanitization of the value of the 'srcset' attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing . This issue affects AngularJS versions 1.3.0-rc.4 and greater. Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .

Rincian

Terbit di NVD

9 September 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1289: Improper Validation of Unsafe Equivalence in Input

EPSS (30 hari)

0,61% peluang dieksploitasi; lebih tinggi dari 47,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://codepen.io/herodevs/full/xxoQRNL/0072e627abe03e9cda373bc75b4c1017 exploit · advisory pihak ketiga
• https://www.herodevs.com/vulnerability-directory/cve-2024-8372 exploit · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20241122-0002/ advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2025/07/msg00005.html