CVE-2025-66035
highPriorität · verfolgen · 0EPSS 0.007 · 54. PerzentilDEEUNLUSEPSS · bewertet 2026-10-27
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain. Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the X-XSRF-TOKEN header. This issue has been patched in versions 19.2.16, 20.3.14, and 21.0.1. A workaround for this issue involves avoiding using protocol-relative URLs (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single /) or fully qualified, trusted absolute URLs.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenRUGGEDCOM RST2428P (6GK6242-6PA00)siemens_psirt
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/ - BehobenSIDIS Primesiemens_psirt
Update to V4.0.800 or later version
- BehobenSIDIS Primecisa_csaf_ot
Update to V4.0.800 or later version
- BehobenRUGGEDCOM RST2428P (6GK6242-6PA00)cisa_csaf_ot
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 4.4–8.6
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (146)
Betroffene Produkte und Versionsbereiche.
Advisories (8)
Hersteller- und Ökosystem-Meldungen dazu.
- NCSC-2026-0079Kwetsbaarheden verholpen in Siemens productenNL2026-03-10csaf · ncsc_nlNL
Siemens heeft kwetsbaarheden verholpen in diverse producten als Heliox, Ruggedcom, SICAM, SIDIS en SIMATIC.
- SSA-253495SSA-253495: Multiple Vulnerabilities in SINEC OS before V4.02026-06-02csaf · siemens_psirtDE
SINEC OS before V4.0 contains multiple vulnerabilities. Siemens has released a new version for RUGGEDCOM RST2428P and recommends to update to the latest version.
- SSA-485750SSA-485750: Multiple Vulnerabilities in SIDIS Prime Before V4.0.8002026-03-10csaf · siemens_psirtDE
SIDIS Prime before V4.0.800 is affected by multiple vulnerabilities in the components OpenSSL, SQLite, and several Node.js packages as described below. Siemens has released a new version of SIDIS Prime and recommends to update to the latest version.
- WID-SEC-W-2025-2689Angular: Schwachstelle ermöglicht Offenlegung von InformationenDeutsch2025-11-26csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Angular ausnutzen, um Informationen offenzulegen.
- WID-SEC-W-2026-0778Dell Secure Connect Gateway Policy Manager: Mehrere SchwachstellenDeutsch2026-03-18csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Dell Secure Connect Gateway Policy Manager ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
- GHSA-58c5-g7wp-6w37Angular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP Client2025-11-26ghsa · osvUS
The vulnerability is a **Credential Leak by App Logic** that leads to the **unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token** to an attacker-controlled domain. Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (`http://` or `https://`) to determine if it is cross-origin. If the URL starts with protocol-relative URL (`//`), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the `X-XSRF-TOKEN` header. ### Impact The token leakage completely bypasses Angular's built-in CSRF protection, allowing an attacker to capture the user's valid XSRF token. Once the token is obtained, the attacker can perform arbitrary Cross-Site Request Forgery (CSRF) attacks against the victim user's session. ### Attack Preconditions 1. The victim's Angular application must have **XSRF protection enabled**. 2. The attacker must be able to make the application send a state-changing HTTP request (e.g., `POST`) to a **protocol-relative URL** (e.g., `//attacker.com`) that they control. ### Patches - 19.2.16 - 20.3.14 - 21.0.1 ### Workarounds Developers should avoid using protocol-relative URLs (URLs starting with `//`) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single `/`) or fully qualified, trusted absolute URLs.
- ICSA-26-071-03Siemens SIDIS Prime2026-03-10icsa · cisa_csaf_otUS
SIDIS Prime before V4.0.800 is affected by multiple vulnerabilities in the components OpenSSL, SQLite, and several Node.js packages as described below. Siemens has released a new version of SIDIS Prime and recommends to update to the latest version.
- ICSA-26-188-05Siemens SINEC OS2026-06-02icsa · cisa_csaf_otUS
SINEC OS before V4.0 contains multiple vulnerabilities. Siemens has released a new version for RUGGEDCOM RST2428P and recommends to update to the latest version.
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (25)
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/angular/angular/commit/0276479e7d0e280e0f8d26fa567d3b7aa97a516fcnnvd
- https://github.com/angular/angular/commit/05fe6686a97fa0bcd3cf157805b3612033f975bccnnvd
- https://github.com/angular/angular/commit/3240d856d942727372a705252f7c8c115394a41ecnnvd
- https://github.com/angular/angular/releasesPatchcnnvd
- https://github.com/angular/angular/releases/tag/19.2.16cnnvd
- https://github.com/angular/angular/releases/tag/20.3.14cnnvd
- https://github.com/angular/angular/releases/tag/21.0.1cnnvd
- https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37cnnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan