Skip to content
fr Sign in
4.8 Medium

CVE-2024-8372 Improper sanitization of the value of the 'srcset' attribute in AngularJS allows attackers to bypass common image source…

Description

Improper sanitization of the value of the 'srcset' attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing . This issue affects AngularJS versions 1.3.0-rc.4 and greater. Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .

Affected products and versions

Product Affected versions Fixed in
AngularJS 1.3 1.3.0-rc.4 → latest No fix stated
angular.js 1.3 1.3.0-rc.4 → latest No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of AngularJS

The 6 CVEs of AngularJS →
CVE-2026-11998 A flaw in AngularJS' Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies for resource URLs… 7.6 High CVE-2025-4690 A regular expression used by AngularJS'  linky https://docs.angularjs.org/api/ngSanitize/filter/linky  filter to… 4.3 Medium CVE-2025-2336 Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '' SVG elements in… 4.8 Medium CVE-2025-0716 Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '' SVG elements in AngularJS allows… 4.8 Medium
Track this CVE