PT-2020-21546 · Angular · Angular-Bmap

Published 2020-09-01 · Updated 2020-09-01

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions angular-bmap version 0.0.9

Description The issue concerns malicious code in version 0.0.9 of the angular-bmap module. When executed in a browser, this code enumerates sensitive fields such as password, cvc, and cardnumber from forms and sends the extracted values to the endpoint "https://js-metrics.com/minjs.php?pl=".

Recommendations Replace version 0.0.9 of the angular-bmap module with a version before or after 0.0.9. Evaluate your application to determine whether user data was compromised due to the malicious code.

Fix

RCE

Weakness Enumeration

CWE-506

Related Identifiers

GHSA-W8HG-MXVH-9H57

Affected Products

Angular-Bmap

References · 4

• https://osv.dev/vulnerability/GHSA-w8hg-mxvh-9h57 · Vendor Advisory
• https://npmjs.com/advisories/614 · Note
• https://snyk.io/vuln/SNYK-JS-ANGULARBMAP-451017 · Note
• ❌ https://github.com/shenfw1987/angular-bmap · Note, Deleted