PT-2022-6868 · Google+3 · Angular+3
Michael Prentice
·
Published
2022-05-01
·
Updated
2026-01-14
·
CVE-2022-25844
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
angular versions 1.7.0 and higher
Description
The issue is related to the use of a regular expression with inefficient computational complexity in the Angular application design environment and single-page application development platform. This can be exploited by a remote attacker to cause a denial of service. The vulnerability is triggered by providing a custom locale rule that allows assigning a high value to the
posPre parameter in NUMBER FORMATS.PATTERNS[1].posPre using the ' '.repeat() method.Recommendations
For versions 1.7.0 and higher, consider disabling the custom locale rule functionality until a fix is available, or restrict the use of the
posPre parameter in NUMBER FORMATS.PATTERNS[1].posPre to prevent assigning high values.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
DoS
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Angular
Debian
Linuxmint
Ubuntu