CVE-2019-14863: XSS
Angular.js is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
Other sources
CVE-2019-14863 There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it. CVE-2022-25869 All versions of package angular are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of <textarea> elements.
— F5
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-14863?
CVE-2019-14863 is a vulnerability in all versions of Angular.js before 1.5.0-beta.0 that allows for cross-site scripting attacks.
How does CVE-2019-14863 affect me?
If you are using an affected version of Angular.js before 1.5.0-beta.0, there is a risk of cross-site scripting attacks on your web application.
What is the severity of CVE-2019-14863?
CVE-2019-14863 has a severity rating of 6.1 (High).
How can I fix CVE-2019-14863?
To fix CVE-2019-14863, upgrade to Angular.js version 1.5.0-beta.0 or higher, which contains the necessary security fixes.
Where can I find more information about CVE-2019-14863?
You can find more information about CVE-2019-14863 at the following references: [IBM X-Force Exchange](https://exchange.xforce.ibmcloud.com/vulnerabilities/173893), [IBM Support](https://www.ibm.com/support/pages/node/6998727), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14863).