CVE-2026-46417

Katalog CVE

CVSS 6.1 · Medium EPSS 0,36%

Kerentanan Server-Side Request Forgery (SSRF) pada angular. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.12, 21.2.13, 20.3.21, and 19.2.22, a Server-Side Request Forgery (SSRF) vulnerability exists in @angular/platform-server. The issue stems from how the server-side rendering (SSR) engine processes the request URL provided to the rendering entry points. When an absolute-form URL (e.g., http://evil.com) is passed to the rendering engine, the internal ServerPlatformLocation can be manipulated into adopting the attacker-controlled domain as the "current" hostname. Consequently, any relative HttpClient requests or PlatformLocation.hostname references are redirected to the attacker controlled server, potentially exposing internal APIs or metadata services. This vulnerability is fixed in 22.0.0-next.12, 21.2.13, 20.3.21, and 19.2.22.

Rincian

Terbit di NVD

22 Juni 2026

Terakhir diubah

15 Juli 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 28,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/angular/angular/pull/68570 issue tracking · patch
• https://github.com/angular/angular/security/advisories/GHSA-rfh7-fxqc-q52v advisory pihak ketiga
• https://access.redhat.com/security/cve/CVE-2026-46417 advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=2491444 advisory pihak ketiga
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46417.json advisory pihak ketiga