CVE-2019-10768
First published: Tue Nov 19 2019(Updated: )
AngularJS could allow a remote attacker to bypass security restrictions, caused by a prototype pollution flaw in the merge function. By sending a specially-crafted request using a constructor payload, a remote attacker could exploit this vulnerability to add or modify properties of Object.prototype.
Credit: report@snyk.io
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Cloud Pak for Business Automation | <=V22.0.2 - V22.0.2-IF004 | |
| IBM Cloud Pak for Business Automation | <=V21.0.3 - V21.0.3-IF020 | |
| IBM Cloud Pak for Business Automation | <=V22.0.1 - V22.0.1-IF006 and later fixesV21.0.2 - V21.0.2-IF012 and later fixesV21.0.1 - V21.0.1-IF007 and later fixesV20.0.1 - V20.0.3 and later fixesV19.0.1 - V19.0.3 and later fixesV18.0.0 - V18.0.2 and later fixes | |
| Angularjs Angular.js | <1.7.9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this security flaw in AngularJS?
The vulnerability ID of this security flaw in AngularJS is CVE-2019-10768.
What is the severity rating of CVE-2019-10768?
CVE-2019-10768 has a severity rating of 7.5 (High).
What is the impact of this vulnerability?
This vulnerability in AngularJS allows a remote attacker to bypass security restrictions and modify properties of Object.prototype.
Which software products are affected by this vulnerability in AngularJS?
IBM Cloud Pak for Business Automation versions V22.0.2 - V22.0.2-IF004 and V21.0.3 - V21.0.3-IF020 are affected by this vulnerability.
How can this vulnerability be exploited?
The vulnerability can be exploited by sending a specially-crafted request using a constructor payload.
- agent/references
- agent/type
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/ibm-support
- agent/software-canonical-lookup-request
- agent/weakness
- agent/severity
- agent/author
- agent/description
- agent/tags
- agent/event
- collector/nvd-index
- vendor/ibm
- canonical/ibm cloud pak for business automation
- version/ibm cloud pak for business automation/v22.0.2 - v22.0.2-if004
- version/ibm cloud pak for business automation/v21.0.3 - v21.0.3-if020
- version/ibm cloud pak for business automation/v22.0.1 - v22.0.1-if006 and later fixesv21.0.2 - v21.0.2-if012 and later fixesv21.0.1 - v21.0.1-if007 and later fixesv20.0.1 - v20.0.3 and later fixesv19.0.1 - v19.0.3 and later fixesv18.0.0 - v18.0.2 and later fixes
- vendor/angularjs
- canonical/angularjs angular.js