PT-2019-12040 · Google+1 · Angularjs+1

Pierre Villard · Publicado 2019-11-19 · Atualizado 2025-11-20 · CVE-2019-10768

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions AngularJS versions prior to 1.7.9

Description The issue concerns the merge() function, which can be tricked into adding or modifying properties of Object.prototype using a proto payload. This may allow an attacker to add or modify an existing property that will exist on all objects. The problem arises because the deprecated API function merge() does not restrict the modification of an Object's prototype.

Recommendations For versions prior to 1.7.9, upgrade to version 1.7.9 or later.

Exploit

Correção

Prototype Pollution

RCE

Enumeração de Fraquezas

CWE-915

CWE-1321

CWE-20

Identificadores relacionados

CVE-2019-10768

GHSA-89MQ-4X47-5V83

RHSA-2022:8849

RHSA-2022:8866

RHSA-2023:0274

SNYK-JS-ANGULAR-534884

Produtos afetados

Angularjs

Debian

Referências · 16

• 🔥 https://snyk.io/vuln/SNYK-JS-ANGULAR-534884 · Exploit
• https://github.com/angular/angular.js/pull/16913 · Nota
• https://github.com/angular/angular.js/commit/add78e62004e80bb1e16ab2dfe224afa8e513bc3 · Nota
• https://github.com/angular/angular.js · Nota
• https://ubuntu.com/security/CVE-2019-10768 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-10768 · Nota de Segurança
• https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E · Nota
• https://cve.org/CVERecord?id=CVE-2019-10768 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2019-10768 · Aviso do Fabricante
• https://npmjs.com/advisories/1343 · Nota
• https://osv.dev/vulnerability/CVE-2019-10768 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-89mq-4x47-5v83 · Aviso do Fabricante
• https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-10768 · Aviso do Fabricante
• https://t.me/cveNotify/143483 · Publicação no Telegram