Lucene search

[email protected]CVE-2019-14863

HistoryJan 02, 2020 - 3:15 p.m.

CVE-2019-14863

2020-01-0215:15:12

CWE-79

[email protected]

web.nvd.nist.gov

cve-2019-14863

angular

web application

security vulnerability

data validation

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.3%

JSON

There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it.

Affected configurations

Vulners

NVD

Node

redhatredhat_package_managerRange≤1.5.0

VendorProductVersionCPE
redhatredhat_package_manager*cpe:2.3:a:redhat:redhat_package_manager:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
redhat	redhat_package_manager	*	cpe:2.3:a:redhat:redhat_package_manager::::::::

CNA Affected

[
  {
    "product": "angular:",
    "vendor": "Red Hat",
    "versions": [
      {
        "status": "affected",
        "version": "all angular versions before 1.5.0-beta.0"
      }
    ]
  }
]