Angular Expressions 注入漏洞

漏洞信息详情

Angular Expressions 1.0.1之前版本中的‘expressions.compile(userControlledInput)’函数存在注入漏洞。攻击者可借助特制请求利用该漏洞在系统上执行任意代码。

目前厂商已发布升级补丁以修复漏洞，补丁获取链接：

https://github.com/peerigon/angular-expressions/security/advisories/GHSA-hxhm-96pp-2m43

来源:blog.angularjs.org

链接:http://blog.angularjs.org/2016/09/angular-16-expression-sandbox-removal.html

来源:github.com

链接:https://github.com/peerigon/angular-expressions/commit/061addfb9a9e932a970e5fcb913d020038e65667

来源:github.com

链接:https://github.com/peerigon/angular-expressions/security/advisories/GHSA-hxhm-96pp-2m43

来源:nvd.nist.gov

链接:https://nvd.nist.gov/vuln/detail/CVE-2020-5219

暂无