WS-2019-0367 (Medium) detected in angular-1.4.2.min.js

[mend-bolt-for-github]

WS-2019-0367 - Medium Severity Vulnerability

Vulnerable Library - angular-1.4.2.min.js

AngularJS is an MVC framework for building web applications. The core features include HTML enhanced with custom component and data-binding capabilities, dependency injection and strong focus on simplicity, testability, maintainability and boiler-plate reduction.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.4.2/angular.min.js

Path to dependency file: /tmp/ws-scm/docs/website/node_modules/autocomplete.js/test/playground_angular.html

Path to vulnerable library: /docs/website/node_modules/autocomplete.js/test/playground_angular.html,/docs/website/node_modules/autocomplete.js/examples/basic_angular.html

Dependency Hierarchy:

• ❌ angular-1.4.2.min.js (Vulnerable Library)

Found in HEAD commit: ca11a4f0e463609c810b9803e548bbb3c771cf8f

Vulnerability Details

Prototype Pollution vulnerability found in Angular before 1.7.9.

Publish Date: 2020-01-08

URL: WS-2019-0367

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://github.com/angular/angular.js/blob/master/CHANGELOG.md#179-pollution-eradication-2019-11-19

Release Date: 2020-01-08

Fix Resolution: angular - 1.7.9

---

Step up your Open Source Security Game with WhiteSource here