Arbitrary Command Execution Affecting org.webjars.npm:angular package, versions [,1.3.2)
Snyk CVSS
Attack Complexity
High
Scope
Changed
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGWEBJARSNPM-479397
- published 23 Jan 2017
- disclosed 3 Nov 2014
- credit Sebastian Lekies, Jann Horn, Gábor Molnár
How to fix?
Upgrade org.webjars.npm:angular
to version 1.3.2 or higher.
Overview
org.webjars.npm:angular is a WebJar for angular.
Affected versions of this package are vulnerable to Arbitrary Command Execution due to the assignment functions accessing constructors functions, allowing attackers to execute their malicious code.