Vulnerabilities

 1 via 1 paths

Dependencies

 438

Source

 GitHub

Commit

 184a6682

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 1
Status
  • 1
  • 0
  • 0

high severity
new

Insertion of Sensitive Information Into Sent Data

  • Vulnerable module: @angular/common
  • Introduced through: @angular/common@17.3.12

Detailed paths

  • Introduced through: angular-template-for-threejs@makimenko/angular-template-for-threejs#184a6682f08b81a0125dfe13769fea056dfa5d8c › @angular/common@17.3.12
    Remediation: Upgrade to @angular/common@19.2.16.

Overview

Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the HttpClient which has a built-in XSRF protection mechanism. An attacker can obtain sensitive authentication tokens by crafting requests using protocol-relative URLs that cause the token to be sent to domains under the attacker's control.

Note: This is only exploitable if XSRF protection is enabled and the application allows requests to protocol-relative URLs.

Workaround

This vulnerability can be mitigated by avoiding the use of protocol-relative URLs (those starting with //) in requests and ensuring all backend communication URLs are either relative paths or fully qualified, trusted absolute URLs.

Remediation

Upgrade @angular/common to version 19.2.16, 20.3.14, 21.0.1 or higher.

References

Insertion of Sensitive Information Into Sent Data vulnerability report