Cross-site scripting in AngularJS - CVE-2022-25869

Vulnerability identifier: #VU87182

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2022-25869

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

AngularJS
IBM Tivoli Netcool Impact
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Tivoli Business Service Manager
IBM MQ
IBM Spectrum Protect Plus
IBM Business Automation Workflow
IBM Cloud Pak for Business Automation
IBM Business Automation Manager Open Editions
IBM OpenPages with Watson
IBM MQ Appliance
Storage Protect Plus Server
BIG-IP

Install update from vendor's website.

IBM Tivoli Netcool Impact - update to 7.1.0.31
IBM Business Automation Manager Open Editions - update to 8.0.8
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.7.1
IBM Tivoli Business Service Manager - update to 6.2.0.4
IBM OpenPages with Watson - addressed in versions 8.3.0.2.7, 9.0.0.1
IBM MQ Appliance - update to 9.3.0.0
IBM MQ - update to 9.3.0
IBM Spectrum Protect Plus - update to 10.1.6.4
Storage Protect Plus Server - update to 10.1.16.3
IBM Business Automation Workflow - addressed in versions 21.0.3 IF033, 23.0.2 IF005
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.33, 23.0.2.5

• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-2949784
• https://glitch.com/edit/%23%21/angular-repro-textarea-xss
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2949783
• https://snyk.io/vuln/SNYK-JS-ANGULAR-2949781
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2949782

• Cross-site scripting in IBM Tivoli Netcool Impact
• Multiple vulnerabilities in IBM OpenPages with Watson
• Multiple vulnerabilities in IBM Tivoli Business Service Manager
• Multiple vulnerabilities in IBM Watson Discovery Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM MQ Appliance
• Multiple vulnerabilities in IBM MQ
• Multiple vulnerabilities in IBM Business Automation Workflow
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM Storage Protect Plus
• Multiple XSS vulnerabilities in BIG-IP Configuration utility (angular)
• Multiple vulnerabilities in IBM Spectrum Protect Plus
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions