PT-2022-11586 · Google · Angular

Miško Hevery · Published 2022-05-26 · Updated 2025-11-20 · CVE-2021-4231

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Angular versions 11.0.4 through 11.1.0-next.2

Description A vulnerability was found in the handling of comments, which can lead to cross site scripting. The manipulation can be launched remotely, but it might require authentication first.

Recommendations For versions up to 11.0.4, upgrade to version 11.0.5. For versions up to 11.1.0-next.2, upgrade to version 11.1.0-next.3. Alternatively, for older versions, upgrade to version 10.2.5.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-4231

GHSA-C75V-2VQ8-878F

RHSA-2023:3623

Affected Products

Angular

References · 12

• https://github.com/angular/angular/commit/ba8da742e3b243e8f43d4c63aa842b44e14f2b09 · Patch
• https://osv.dev/vulnerability/CVE-2021-4231 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-4231 · Security Note
• https://osv.dev/vulnerability/GHSA-c75v-2vq8-878f · Vendor Advisory
• https://github.com/angular/angular · Note
• https://github.com/angular/angular/commit/0aa220bc0000fc4d1651ec388975bbf5baa1da36 · Note
• https://github.com/angular/angular/commit/47d9b6d72dab9d60c96bc1c3604219f6385649ea · Note
• https://github.com/angular/angular/issues/40136 · Note
• https://t.me/cibsecurity/43381 · Telegram Post
• https://t.me/cveNotify/143495 · Telegram Post
• https://vuldb.com/?id.181356 · Note
• https://security.snyk.io/vuln/SNYK-JS-ANGULARCORE-1070902 · Note