CVE-2019-14863: XSS
First published: Thu Jan 02 2020(Updated: )
Angular.js is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Cloud Pak for Business Automation | <=V22.0.2 - V22.0.2-IF004 | |
| IBM Cloud Pak for Business Automation | <=V21.0.3 - V21.0.3-IF020 | |
| IBM Cloud Pak for Business Automation | <=V22.0.1 - V22.0.1-IF006 and later fixesV21.0.2 - V21.0.2-IF012 and later fixesV21.0.1 - V21.0.1-IF007 and later fixesV20.0.1 - V20.0.3 and later fixesV19.0.1 - V19.0.3 and later fixesV18.0.0 - V18.0.2 and later fixes | |
| Angularjs Angular.js | >=1.0.0<=1.4.14 | |
| Redhat Decision Manager | =7.0 | |
| Redhat Process Automation | =7.0 | |
| F5 BIG-IP | >=17.1.0<=17.1.1 | |
| F5 BIG-IP | >=16.1.0<=16.1.5 | |
| F5 BIG-IP | >=15.1.0<=15.1.10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-14863?
CVE-2019-14863 is a vulnerability in all versions of Angular.js before 1.5.0-beta.0 that allows for cross-site scripting attacks.
How does CVE-2019-14863 affect me?
If you are using an affected version of Angular.js before 1.5.0-beta.0, there is a risk of cross-site scripting attacks on your web application.
What is the severity of CVE-2019-14863?
CVE-2019-14863 has a severity rating of 6.1 (High).
How can I fix CVE-2019-14863?
To fix CVE-2019-14863, upgrade to Angular.js version 1.5.0-beta.0 or higher, which contains the necessary security fixes.
Where can I find more information about CVE-2019-14863?
You can find more information about CVE-2019-14863 at the following references: [IBM X-Force Exchange](https://exchange.xforce.ibmcloud.com/vulnerabilities/173893), [IBM Support](https://www.ibm.com/support/pages/node/6998727), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14863).
- agent/type
- agent/weakness
- agent/author
- agent/remedy
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/mitre-cve
- source/MITRE
- agent/first-publish-date
- collector/f5-advisory
- source/F5
- alias/CVE-2019-14863
- alias/CVE-2022-25869
- agent/software-canonical-lookup
- agent/severity
- agent/tags
- agent/references
- agent/softwarecombine
- agent/last-modified-date
- agent/description
- agent/event
- collector/ibm-support
- source/IBM
- vendor/angularjs
- canonical/angularjs angular.js
- version/angularjs angular.js/1.0.0
- version/angularjs angular.js/1.4.14
- vendor/redhat
- canonical/redhat decision manager
- version/redhat decision manager/7.0
- canonical/redhat process automation
- version/redhat process automation/7.0
- vendor/f5
- canonical/f5 big-ip
- version/f5 big-ip/17.1.0
- version/f5 big-ip/17.1.1
- version/f5 big-ip/16.1.0
- version/f5 big-ip/16.1.5
- version/f5 big-ip/15.1.0
- version/f5 big-ip/15.1.10
- vendor/ibm
- canonical/ibm cloud pak for business automation
- version/ibm cloud pak for business automation/v22.0.2 - v22.0.2-if004
- version/ibm cloud pak for business automation/v21.0.3 - v21.0.3-if020
- version/ibm cloud pak for business automation/v22.0.1 - v22.0.1-if006 and later fixesv21.0.2 - v21.0.2-if012 and later fixesv21.0.1 - v21.0.1-if007 and later fixesv20.0.1 - v20.0.3 and later fixesv19.0.1 - v19.0.3 and later fixesv18.0.0 - v18.0.2 and later fixes