Vulnerabilities

 1 via 1 paths

Dependencies

 11

Source

 GitHub

Commit

 d577ba9f

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 1
Status
  • 1
  • 0
  • 0

high severity
new

Insertion of Sensitive Information Into Sent Data

  • Vulnerable module: @angular/common
  • Introduced through: @angular/common@14.3.0

Detailed paths

  • Introduced through: angular-resize-event@vdolek/angular-resize-event#d577ba9f01ba675e5e149971e0016ea7b2010fb7 › @angular/common@14.3.0
    Remediation: Upgrade to @angular/common@19.2.16.

Overview

Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the HttpClient which has a built-in XSRF protection mechanism. An attacker can obtain sensitive authentication tokens by crafting requests using protocol-relative URLs that cause the token to be sent to domains under the attacker's control.

Note: This is only exploitable if XSRF protection is enabled and the application allows requests to protocol-relative URLs.

Workaround

This vulnerability can be mitigated by avoiding the use of protocol-relative URLs (those starting with //) in requests and ensuring all backend communication URLs are either relative paths or fully qualified, trusted absolute URLs.

Remediation

Upgrade @angular/common to version 19.2.16, 20.3.14, 21.0.1 or higher.

References

Insertion of Sensitive Information Into Sent Data vulnerability report