CVE-2024-21490

highPriorität · verfolgen · 41EPSS 0.019 · 79. PerzentilExploit · PoCDEEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

1.89% (79th) EPSS

CVSS 7.5 · high

Is it mine?

28 products

Prüfe deine Angriffsfläche

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · bewertet 2026-10-26

This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of service. **Note:** This package is EOL and will not receive any updates to address this issue. Users should migrate to [@angular/core](https://www.npmjs.com/package/@angular/core).

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.5

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 3.6

v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Psecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · report@snyk.ioAusnutzbarkeit 3.9 · Auswirkung 3.6

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · OSV

v3.17.1highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Psecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Trackcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-1333USprimärCWE-1333USCWE-1333US

Exploits (1)

Öffentlicher Proof-of-Concept- und Exploit-Code.

RoninForge/roninforge-angularjs-migrationAngularJS 1.x -> Angular 18 migration guidance for GitHub Copilot. Source-of-truth repo for github/awesome-copilot/instructions/angularjs-to-angular-18.instructions.md. 62 LLM regressions across 3 modes. AngularJS EOL since Dec 31 2021; CVE-2024-21490 unpatched.PoC · poc_in_github

betroffene Produkte (28)

Betroffene Produkte und Versionsbereiche.

Debian Linuxalle Versionencert_bundDEcpe:/o:debian:debian_linux:-
HCL BigFixalle Versionencert_bundDEcpe:/a:hcltech:bigfix:-
Open Source Angular <1.5.19alle Versionencert_bundDE
Open Source Angular <1.9.3alle Versionencert_bundDE
Open Source Camunda <7.19.12alle Versionencert_bundDE
Open Source Camunda <7.20.5alle Versionencert_bundDE
Open Source Camunda <7.21.0-alpha3alle Versionencert_bundDE
Ubuntu Linuxalle Versionencert_bundDEcpe:/o:canonical:ubuntu_linux:-
Open Source Angular< 1.5.19cert_bundDE
Open Source Angular< 1.9.3cert_bundDE
Open Source Camunda< 7.19.12cert_bundDE
Open Source Camunda< 7.20.5cert_bundDE
Open Source Camunda< 7.21.0-alpha3cert_bundDE
n/a AngularJS1.3.0 → *enisa_euvdEU
n/a angular1.3.0 → *enisa_euvdEU
n/a org.webjars.bower:angular1.3.0 → *enisa_euvdEU
n/a org.webjars.npm:angular1.3.0 → *enisa_euvdEU
Google Inc Angular1.3.0 → 1.8.3fstec_bduRU
Red Hat Inc. Red Hat JBoss Fuse≤ 7fstec_bduRU
Red Hat Inc. Red Hat Quay≤ 3fstec_bduRU

20 von 28 angezeigt

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

WID-SEC-W-2024-0341Angular: Schwachstelle ermöglicht Denial of ServiceDeutsch2024-02-11csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Angular ausnutzen, um einen Denial of Service Angriff durchzuführen.
GHSA-4w4v-5hc9-xrr2angular vulnerable to super-linear runtime due to backtracking2024-02-10ghsa · osvUS
This affects versions of the package angular from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With a large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of service. **Note:** This package is EOL and will not receive any updates to address this issue. Users should migrate to [@angular/core](https://www.npmjs.com/package/@angular/core).

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu cert_bund osv NVD CVE.org MITRE

veröffentlicht 2024-02-10geändert 2026-06-29

verwandt (603)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2023-3364US	high7.5	44.5% (99th)	—	2023-08-02
An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2…
CVE-2022-24713US	high7.5	14.5% (97th)	Exploit	2022-03-08
regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted rege…
CVE-2024-8124US	high7.5	40.2% (99th)	—	2024-09-12
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.1.7, starting from 17.2 prior to 17.2.5, starting from 17.3 prior to 17.3.2 which cou…
CVE-2021-3749US	high7.5	8.52% (95th)	Exploit	2021-08-31
axios is vulnerable to Inefficient Regular Expression Complexity
CVE-2024-25126US	high7.5	35.4% (98th)	—	2024-02-29
Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible deni…

+598 weitere

Referenzen (19)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan