Medium severity · published Mar 30, 2023
CVE-2023-26117
Versions of the package angular from 1.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the $resource service due to the usage of an insecure regular…
5.3
CVSS
1.7%
EPSS
No
On KEV
Description
Versions of the package angular from 1.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the $resource service due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AN
angular ·
1.0.0 · source: vendor
OR
org.webjars.bower:angular ·
1.0.0 · source: vendor
OR
org.webjars.bowergithub.angular:angular ·
0 · source: vendor
OR
org.webjars.npm:angular ·
1.0.0 · source: vendor
AN
Angularjs · Angularjs
1.0.0 through 1.8.3 · source: NVD
FE
Fedora · Fedoraproject
38 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-26117
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-26117
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OQWJLE5WE33WNMA54XSJIDXBRK2KL3XJ/
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UDKFLKJ6VZKL52AFVW2OVZRMJWHMW55K/
Exploit
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-5406323
Exploit
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-5406325
Exploit
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-5406324
Exploit
https://security.snyk.io/vuln/SNYK-JS-ANGULAR-3373045
More from angular
7.5
CVE-2024-21490
This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0
5.3
CVE-2023-26116
Versions of the package angular from 1.2.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the angular.copy() utility function due to the usage of an insecure…
5.3
CVE-2023-26118
Versions of the package angular from 1.4.9 are vulnerable to Regular Expression Denial of Service (ReDoS) via the <input type="url"> element due to the usage of an insecure…