Read the docs
TI-2024-07763 Aliases CVE-2024-8372GHSA-m9gf-397r-hwpg

AngularJS improper sanitization in 'srcset' attribute

Priority MEDIUM 55CWE-1289Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · Low · Low
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Improper sanitization of the value of the 'srcset' attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing . This issue affects AngularJS versions 1.3.0-rc.4 and greater. Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00609 49th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD and the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GoogleAngularJS>=1.3.0-rc.4—No fix listedCNA
—angular (npm)1.3.0-rc.4 – 1.8.3—No fix listedGHSA-m9gf-397r-hwpg
  • AngularJS VendorGoogle Affected >=1.3.0-rc.4 Fixed in — No fix listed CNA
  • angular (npm) Vendor— Affected 1.3.0-rc.4 – 1.8.3 Fixed in — No fix listed GHSA-m9gf-397r-hwpg

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:angularjs:angularjs:*:*:*:*:*:*:*:*1.3.1 – 1.8.3VulnerableAngularjs
cpe:2.3:a:angularjs:angularjs:1.3.0:rc4:*:*:*:*:*:*1.3.0 rc4VulnerableAngularjs
cpe:2.3:a:angularjs:angularjs:1.3.0:rc5:*:*:*:*:*:*1.3.0 rc5VulnerableAngularjs
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*not specified by NVDVulnerableNetApp
  • cpe:2.3:a:angularjs:angularjs:*:*:*:*:*:*:*:* Versions 1.3.1 – 1.8.3 Vulnerable ·Angularjs
  • cpe:2.3:a:angularjs:angularjs:1.3.0:rc4:*:*:*:*:*:* Versions 1.3.0 rc4 Vulnerable ·Angularjs
  • cpe:2.3:a:angularjs:angularjs:1.3.0:rc5:*:*:*:*:*:* Versions 1.3.0 rc5 Vulnerable ·Angularjs
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Not affected: 13 products
  • Logging Subsystem for Red Hat OpenShift
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Fuse 7
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenStack Platform 16.2
  • Red Hat Quay 3
  • Red Hat Single Sign-On 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-8372
  2. 2026-10-03 Alias added: GHSA-m9gf-397r-hwpg

References

Exploit 2

Advisory 2

Other 3

  • TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-07390 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2024-04898 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2024-04600 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2024-04346 Use after free in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2023-05824 Integer overflow in Google Chrome KEVCVSS 3.1CRITICAL 9.6
See all 17247 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences