GHSA-wfw3-rgfr-6g67

ghsaUSosv

XSS via Angular Expression in ag-grid

view advisory published 2020-09-01Licence: CC-BY-4.0

Affected versions of `ag-grid` are vulnerable to Cross-site Scripting (XSS) via Angular Expressions, if used in combination with AngularJS. ## Recommendation Avoid using `ag-grid` in combination with AngularJS until a fix is available.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2017-16009US	medium6.1	1.02% (63rd)	—	2018-06-04
ag-grid is an advanced data grid that is library agnostic. ag-grid is vulnerable to Cross-site Scripting (XSS) via Angular Expressions, if AngularJS is used in combination with ag-…

references

External citations — patches, advisories, analysis.

https://github.com/ag-grid/ag-gridPACKAGE
https://github.com/ceolter/ag-grid/issues/1287WEB
https://nvd.nist.gov/vuln/detail/CVE-2017-16009ADVISORY
https://spring.io/blog/2016/01/28/angularjs-escaping-the-expression-sandbox-for-xssWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan