PT-2022-6869 · Microsoft+1 · Internet Explorer+1

Michael Prentice · Published 2022-07-15 · Updated 2025-07-15 · CVE-2022-25869

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions angular versions prior to the fixed version

Description The issue is related to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, allowing interpolation of elements. This occurs because the application does not take adequate measures to protect the structure of web pages, potentially enabling a remote attacker to conduct an XSS attack.

Recommendations For all versions of angular, consider migrating to the actively maintained package @angular/core to receive security updates, as the angular package is deprecated. As a temporary workaround, consider restricting the use of the insecure page caching feature in the Internet Explorer browser until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-05242

CVE-2022-25869

GHSA-PRC3-VJFX-VHM9

SNYK-JAVA-ORGWEBJARSBOWER-2949783

SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-2949784

SNYK-JAVA-ORGWEBJARSNPM-2949782

SNYK-JS-ANGULAR-2949781

Affected Products

Debian

Internet Explorer

References · 25

• 🔥 https://snyk.io/vuln/SNYK-JS-ANGULAR-2949781 · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-2949784 · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2949782 · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2949783 · Exploit
• https://osv.dev/vulnerability/CVE-2022-25869 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-25869 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25869 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-25869 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-25869 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-25869 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-25869 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-prc3-vjfx-vhm9 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05242 · Security Note
• https://t.me/cibsecurity/46375 · Telegram Post
• https://security.snyk.io/vuln/SNYK-DOTNET-ANGULARJS-10771617 · Note