5.4

CVE-2021-4231: angular Cross-site Scripting

CVSS: 5.4v3.1MediumModified
AliasesCGA-3wjq-fp7m-q7v3CGA-42g7-3v4w-5c2rCGA-4c8m-62mw-74ph
Published 26-05-2022Last modified 15-04-2025
Open JSON

Vulnerability summary

CVE-2021-4231 is a medium (CVSS 5.4) Cross-site Scripting vulnerability in angular. EPSS estimates a 1.18% chance of exploitation in the next 30 days, higher than 67.2% of scored vulnerabilities.

Overall risk
22/100
0100
Low · default modelHow is this calculated?
CVSS score
5.4/10
010
Medium · v3.1 (NVD)
EPSS score
1.18%
0%100%
Low · +0.02 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 2
RHSA-2023:3623CGA-9X5W-X8WQ-MXHQCGA-W94M-XV5Q-8X3H

Timeline

  1. 26-05-2022
    PublishedVulnerability first disclosed.
  2. 15-04-2025
    Last modifiedVulnerability information updated.

Description

A vulnerability was found in Angular up to 11.0.4/11.1.0-next.2. It has been classified as problematic. Affected is the handling of comments. The manipulation leads to cross site scripting. It is possible to launch the attack remotely but it might require an authentication first. Upgrading to version 11.0.5 and 11.1.0-next.3 is able to address this issue. The name of the patch is ba8da742e3b243e8f43d4c63aa842b44e14f2b09. It is recommended to upgrade the affected component.

CVSS metrics

6 scores · 5 sources · 2 versions

EPSS trend

Probability

1.18%

Chance of exploitation in the next 30 days

Percentile

67%

Versus all other CVEs

30-day change

+0.02 pp

From 1.16% on 18-09-2026

18-09-202618-10-2026
EPSS score
1.18%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard12 products
  • katib-earlystopping< 0.19.0-r31
  • katib-suggestion-goptuna-compat< 0.19.0-r40
  • katib-suggestion-hyperband< 0.19.0-r31
  • katib-suggestion-hyperopt< 0.19.0-r40 | < 0.19.0-r31
  • katib-suggestion-nas-darts< 0.19.0-r31
Wolfi12 products
  • katib-earlystopping< 0.19.0-r31
  • katib-suggestion-goptuna-compat< 0.19.0-r40
  • katib-suggestion-hyperband< 0.19.0-r31
  • katib-suggestion-hyperopt< 0.19.0-r40 | < 0.19.0-r31
  • katib-suggestion-nas-darts< 0.19.0-r31
@angular1 product
  • core≥ 11.0.0, < 11.0.5 | ≥ 11.1.0-next.0, < 11.1.0-next.3 | < 10.2.5
Angular1 product
  • angularEOL11.1.0:next0 | 11.1.0:next1 | 11.1.0:next2
Angularjs1 product
Unspecified1 product
  • angular11.0.0 | 11.0.1 | 11.0.2 | 11.0.3 | 11.0.4 | 11.1.0-next.0 | 11.1.0-next.1 | 11.1.0-next.2

6 vendors · 28 products

References

8 links