CVE-2021-4231
Angular vulnerable to Cross-site Scripting
5.4
MEDIUM
CVSS 3.1
EPSS 1.2%
Description
A vulnerability was found in Angular up to 11.0.4/11.1.0-next.2. It has been classified as problematic. Affected is the handling of comments. The manipulation leads to cross site scripting. It is possible to launch the attack remotely but it might require an authentication first. Upgrading to version 10.2.5, 11.0.5 or 11.1.0-next.3 is advised to to address this issue.
How to fix CVE-2021-4231
To remediate CVE-2021-4231, upgrade the affected package to a fixed version below.
- —upgrade to 11.0.5 or later
Is CVE-2021-4231 being exploited?
Low — EPSS is 1.2%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- >= 11.0.0, < 11.0.5
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |