Cross-site scripting in Angular - CVE-2021-4231

Vulnerability identifier: #VU77476

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2021-4231

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Angular
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
webMethods Managed File Transfer
Robotic Process Automation for Cloud Pak
ansible-collection-ansible-posix (Red Hat package)
cephadm-ansible (Red Hat package)
IBM Watson Discovery for IBM Cloud Pak for Data
Ceph
OpenShift Data Foundation (formerly OpenShift Container Storage)
Red Hat Ceph Storage

Install updates from vendor's website.

Angular - addressed in versions 11.0.5, 11.1.0-next.3
ansible-collection-ansible-posix (Red Hat package) - update to 1.2.0-1.3.el9ost
cephadm-ansible (Red Hat package) - update to 2.15.0-1.el9cp
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.7.1
OpenShift Data Foundation (formerly OpenShift Container Storage) - update to 4.13.0
Red Hat Ceph Storage - update to 6.1
Ceph - update to 17.2.6-70.el9cp
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.2, 23.0.2

• https://vuldb.com/?id.181356
• https://github.com/angular/angular/issues/40136
• https://security.snyk.io/vuln/SNYK-JS-ANGULARCORE-1070902
• https://github.com/angular/angular/commit/ba8da742e3b243e8f43d4c63aa842b44e14f2b09

• XSS in Angular
• Multiple vulnerabilities in Red Hat Ceph Storage 6.1
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation 4.13
• Multiple vulnerabilities in IBM Watson Discovery Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Multiple vulnerabilities in IBM webMethods Managed File Transfer