oliversalzburg/i18n-node-angular · Security
Denial of Service and Content Injection in i18n-node-angular
- GHSA ID
- GHSA-97gv-3p2c-xw7j
- CVE ID
- CVE-2016-10524
- Severity
- high
- Published
- Updated
- CVSS
- 8.2 · CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:H
- CVSS v3
- 8.2 · CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:H
Description
Versions of i18n-node-angular prior to 1.4.0 are affected by denial of service and cross-site scripting vulnerabilities. The vulnerabilities exist in a REST endpoint that was created for development purposes, but was not disabled in production in affected versions.
Recommendation
Update to version 1.4.0 or later.
CWEs
- CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- CWE-400 · Uncontrolled Resource Consumption