Angular-translate vulnerable to XSS via crafted key
CVE-2024-33665

6.1MEDIUM

Key Information:

Vendor

angular-translate

Vendor
CVE Published:
26 April 2024

What is CVE-2024-33665?

angular-translate through 2.19.1 allows XSS via a crafted key that is used by the translate directive. NOTE: the vendor indicates that there is no documentation indicating that a key is supposed to be safe against XSS attacks.

References

https://github.com/angular-translate/angular-translate/is...
https://stackblitz.com/github/neverendingsupport/angular-...
http://docs.herodevs.com/docs/2024-Angular-Translate-XSS

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.