CVE-2022-25869
Published: 15 July 2022
Summary
CVE-2022-25869 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Angularjs Angularjs. Its CVSS base score is 4.2 (Medium).
Operationally, ranked in the top 10.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2022-25869 is a cross-site scripting vulnerability present in all versions of the angular, angularjs.core, and angularjs packages. It arises because these packages permit interpolation of textarea elements when pages are cached insecurely by the Internet Explorer browser, allowing attacker-controlled content to be executed in the context of the cached page.
An unauthenticated remote attacker can exploit the flaw by supplying malicious input that survives caching in Internet Explorer; successful exploitation yields limited read and write access within the victim’s session, though the attack requires user interaction and high complexity as reflected in its CVSS 4.2 score.
Public references consist of Snyk vulnerability records for multiple language ecosystems and a proof-of-concept page hosted by NeverEndingSupport; these sources document the issue but do not describe vendor patches or configuration work-arounds.
EPSS for the CVE rose from low values to a recorded peak of 0.0771 before receding to the current 0.0427, indicating a modest, transient increase in observed exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-6389
Vulnerability details
All versions of the package angular; all versions of the package angularjs.core; all versions of the package angularjs are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of <textarea> elements.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.