description: Versions of the package angular from 1.4.9 are vulnerable to Regular Expression Denial of Service (ReDoS) via the <input type="url"> element due to the usage of an insecure regular expression in the input[url] functionality. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.
problem types: Regular Expression Denial of Service (ReDoS)
affected:
{
product: angular
vendor: n/a
versions:
lessThan: *, status: affected, version: 1.4.9, versionType: semver
}
{
product: org.webjars.bower:angular
vendor: n/a
versions:
lessThan: *, status: affected, version: 1.4.9, versionType: semver
}
{
product: org.webjars.npm:angular
vendor: n/a
versions:
lessThan: *, status: affected, version: 1.4.9, versionType: semver
}
{
product: org.webjars.bowergithub.angular:angular
vendor: n/a
versions:
lessThan: *, status: affected, version: 0, versionType: semver
}
metrics:
cvssV3_1: [
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P
version: 3.1
]