Prototype pollution in AngularJS - CVE-2019-10768
Published: December 4, 2019
Vulnerability identifier: #VU23382
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2019-10768
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data within the merge() function. A remote attacker can trick the victim to follow a adding or modifying properties of `Object.prototype` using a `__proto__` payload and execute arbitrary script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
Affected software
AngularJS
Control Desk
IBM Business Automation Manager Open Editions
IBM Cloud Pak for Watson AIOps
Storage Protect Plus Server
IBM DataPower Gateway
BIG-IP
python-XStatic-Angular (Red Hat package)
IBM Transformation Extender Advanced
IBM Spectrum Protect Plus
Red Hat OpenStack
IBM Business Automation Workflow
IBM Cloud Pak for Business Automation
Control Desk
IBM Business Automation Manager Open Editions
IBM Cloud Pak for Watson AIOps
Storage Protect Plus Server
IBM DataPower Gateway
BIG-IP
python-XStatic-Angular (Red Hat package)
IBM Transformation Extender Advanced
IBM Spectrum Protect Plus
Red Hat OpenStack
IBM Business Automation Workflow
IBM Cloud Pak for Business Automation
How to mitigate CVE-2019-10768
Install updates from vendor's website.
AngularJS - update to 1.7.9
IBM Business Automation Manager Open Editions - update to 8.0.8
IBM DataPower Gateway - addressed in versions 10.0.1.4, 10.0.3.0, 2018.4.1.17
python-XStatic-Angular (Red Hat package) - addressed in versions 1.5.8.0-13.el8ost, 1.5.8.0-15.el9ost
IBM Cloud Pak for Watson AIOps - update to 4.1
IBM Transformation Extender Advanced - addressed in versions 10.0.1.11, 10.0.2.0
IBM Spectrum Protect Plus - update to 10.1.6.4
Storage Protect Plus Server - update to 10.1.16.3
Red Hat OpenStack - addressed in versions 16.1.9, 16.2.4, 17.0
IBM Business Automation Workflow - addressed in versions 21.0.3 IF021, 22.0.2 IF005
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.21, 22.0.2.5
IBM Business Automation Manager Open Editions - update to 8.0.8
IBM DataPower Gateway - addressed in versions 10.0.1.4, 10.0.3.0, 2018.4.1.17
python-XStatic-Angular (Red Hat package) - addressed in versions 1.5.8.0-13.el8ost, 1.5.8.0-15.el9ost
IBM Cloud Pak for Watson AIOps - update to 4.1
IBM Transformation Extender Advanced - addressed in versions 10.0.1.11, 10.0.2.0
IBM Spectrum Protect Plus - update to 10.1.6.4
Storage Protect Plus Server - update to 10.1.16.3
Red Hat OpenStack - addressed in versions 16.1.9, 16.2.4, 17.0
IBM Business Automation Workflow - addressed in versions 21.0.3 IF021, 22.0.2 IF005
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.21, 22.0.2.5
External References
Related Security Bulletins
- Cross-site scripting in AngularJS
- Multiple vulnerabilities in IBM DataPower Gateway
- Red Hat OpenStack Platform 16.2 update python-XStatic-Angular
- Red Hat OpenStack Platform 16.1 update for python-XStatic-Angular
- Prototype pollution in Red Hat OpenStack Platform
- Multiple vulnerabilities in IBM Business Automation Workflow
- Multiple vulnerabilities in IBM Cloud Pak for Business Automation
- Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
- Multiple vulnerabilities in IBM Control Desk
- Multiple vulnerabilities in IBM Storage Protect Plus
- Multiple vulnerabilities in BIG-IP Configuration utility (angular)
- Multiple vulnerabilities in IBM Spectrum Protect Plus
- Multiple vulnerabilities in IBM Business Automation Manager Open Editions
- Multiple vulnerabilities in IBM Transformation Extender Advanced