PT-2020-21465 · Angular · Angular-Material-Sidenav-Rnd

Published 2020-09-01 · Updated 2020-09-01

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions angular-material-sidenav-rnd version 0.1.1

Description The issue concerns malicious code in version 0.1.1 of the angular-material-sidenav-rnd module. When executed in a browser, this code enumerates sensitive fields such as password, cvc, and cardnumber from forms and sends the extracted values to the endpoint "https://js-metrics.com/minjs.php?pl=".

Recommendations Replace version 0.1.1 of the angular-material-sidenav-rnd module with a version before or after 0.1.1. Evaluate your application to determine whether user data was compromised due to the presence of the malicious code in version 0.1.1.

Fix

RCE

Weakness Enumeration

CWE-506

Related Identifiers

GHSA-QMXF-FXQ7-W59F

Affected Products

Angular-Material-Sidenav-Rnd

References · 5

• https://osv.dev/vulnerability/GHSA-qmxf-fxq7-w59f · Vendor Advisory
• https://github.com/sovanna/angular-material-sidenav · Note
• https://github.com/musabgosset/angular-material-sidenav · Note
• https://npmjs.com/advisories/615 · Note
• https://snyk.io/vuln/SNYK-JS-ANGULARMATERIALSIDENAVRND-451015 · Note