CVE-2024-8372: AngularJS improper sanitization in 'srcset' attribute
Description
Improper sanitization of the value of the 'srcset' attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing .
This issue affects AngularJS versions 1.3.0-rc.4 and greater.
Note:
The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .
Classification
CVE ID: CVE-2024-8372
CVSS Base Severity: MEDIUM
CVSS Base Score: 4.8
CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Affected Products
Vendor: Google
Product: AngularJS
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.15% (probability of being exploited)
EPSS Percentile: 36.4% (scored less or equal to compared to others)
EPSS Date: 2025-05-27 (when was this score calculated)
Stakeholder-Specific Vulnerability Categorization (SSVC)
SSVC Exploitation: poc
SSVC Technical Impact: partial
SSVC Automatable: false
References
https://nvd.nist.gov/vuln/detail/CVE-2024-8372https://www.herodevs.com/vulnerability-directory/cve-2024-8372
https://codepen.io/herodevs/full/xxoQRNL/0072e627abe03e9cda373bc75b4c1017