CVE-2019-10768: Input Validation
AngularJS could allow a remote attacker to bypass security restrictions, caused by a prototype pollution flaw in the merge function. By sending a specially-crafted request using a constructor payload, a remote attacker could exploit this vulnerability to add or modify properties of Object.prototype.
Other sources
CVE-2019-10768 In AngularJS before 1.7.9 the function merge() could be tricked into adding or modifying properties of Object.prototype using a proto payload. CVE-2023-26116 Versions of the package angular from 1.2.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the angular.copy() utility function due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.
— F5
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID of this security flaw in AngularJS?
The vulnerability ID of this security flaw in AngularJS is CVE-2019-10768.
What is the severity rating of CVE-2019-10768?
CVE-2019-10768 has a severity rating of 7.5 (High).
What is the impact of this vulnerability?
This vulnerability in AngularJS allows a remote attacker to bypass security restrictions and modify properties of Object.prototype.
Which software products are affected by this vulnerability in AngularJS?
IBM Cloud Pak for Business Automation versions V22.0.2 - V22.0.2-IF004 and V21.0.3 - V21.0.3-IF020 are affected by this vulnerability.
How can this vulnerability be exploited?
The vulnerability can be exploited by sending a specially-crafted request using a constructor payload.