{"basis":"claimed","id":"CVE-2024-8372","name":"AngularJS improper sanitization in 'srcset' attribute","vendorProject":"Google","product":"AngularJS","publishedAt":"2024-09-09","cvss":{"score":4.8,"severity":"MEDIUM","version":"3.1"},"exploited":null,"epss":{"score":0.00609,"percentile":0.49147,"date":"2026-11-02"},"coverage":{"cloudflare":{"status":"no_history","firstOn":null,"daysToRule":null},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"none","firstOn":null,"daysToRule":null},"fastly":{"status":"no_history","firstOn":null,"daysToRule":null},"f5":{"status":"rule","firstOn":"2025-04-28","daysToRule":231},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"none","firstOn":null,"daysToRule":null}},"title":"AngularJS improper sanitization in 'srcset' attribute","description":"Improper sanitization of the value of the 'srcset' attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of  Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing .\n\nThis issue affects AngularJS versions 1.3.0-rc.4 and greater.\n\nNote:\nThe AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see  here https://docs.angularjs.org/misc/version-support-status .","cwes":["CWE-1289"],"vendors":[{"vendor":"cloudflare","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"rule","basis":"claimed","firstOn":"2025-04-28","firstIsNew":true,"daysToRule":231,"daysAtMost":null,"freePlan":false,"claims":[{"id":"9b23916a8244164686bdec2db5e54afbceec0a5d517144f1a96c3ebd5c1c65e9","cve_id":"CVE-2024-8372","vendor":"f5","product":"Attack signatures","rule_id":"200101909","rule_name":"Angular.js attribute ng-Srcset (Parameter)","change":"new","default_action":null,"published_on":"2025-04-28","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200101909 \"Angular.js attribute ng-Srcset (Parameter)\" (Cross Site Scripting (XSS), risk High), systems: System Independent, AngularJS. References: CVE-2024-8372.","first_seen_at":"2026-11-02T21:00:26.482Z"},{"id":"95c7392979548d5eca9a6e556c7ee85b0c63b967f92b3478e82969757f95d0de","cve_id":"CVE-2024-8372","vendor":"f5","product":"Attack signatures","rule_id":"200101910","rule_name":"Angular.js attribute ng-Srcset (Header)","change":"new","default_action":null,"published_on":"2025-04-28","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200101910 \"Angular.js attribute ng-Srcset (Header)\" (Cross Site Scripting (XSS), risk High), systems: System Independent, AngularJS. References: CVE-2024-8372.","first_seen_at":"2026-11-02T21:00:26.482Z"},{"id":"447b02e2122caa23fc763d6f1d80f201e730b7e72744b6ad81346cbf2774d3f7","cve_id":"CVE-2024-8372","vendor":"f5","product":"Attack signatures","rule_id":"200101911","rule_name":"Angular.js attribute ng-Srcset (URI)","change":"new","default_action":null,"published_on":"2025-04-28","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200101911 \"Angular.js attribute ng-Srcset (URI)\" (Cross Site Scripting (XSS), risk High), systems: System Independent, AngularJS. References: CVE-2024-8372.","first_seen_at":"2026-11-02T21:00:26.482Z"},{"id":"d76d7e7859e7d6df92a62ad9bacffe6e60bbda1d2c4066bbdda4274e1dc072a7","cve_id":"CVE-2024-8372","vendor":"f5","product":"Attack signatures","rule_id":"200101912","rule_name":"Angular.js attribute ng-Attr-Srcset (Parameter)","change":"new","default_action":null,"published_on":"2025-04-28","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200101912 \"Angular.js attribute ng-Attr-Srcset (Parameter)\" (Cross Site Scripting (XSS), risk High), systems: System Independent, AngularJS. References: CVE-2024-8372.","first_seen_at":"2026-11-02T21:00:26.482Z"},{"id":"4fe14622c28a6fd99421a67668fa5690c5e54c600a5292b343d9404629a03ec8","cve_id":"CVE-2024-8372","vendor":"f5","product":"Attack signatures","rule_id":"200101913","rule_name":"Angular.js attribute ng-Attr-Srcset (Header)","change":"new","default_action":null,"published_on":"2025-04-28","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200101913 \"Angular.js attribute ng-Attr-Srcset (Header)\" (Cross Site Scripting (XSS), risk High), systems: System Independent, AngularJS. References: CVE-2024-8372.","first_seen_at":"2026-11-02T21:00:26.482Z"},{"id":"f7e4aabdbf714accadf4c13f16c9316c1d949a87faa41f68421e9eecae95de04","cve_id":"CVE-2024-8372","vendor":"f5","product":"Attack signatures","rule_id":"200101914","rule_name":"Angular.js attribute ng-Attr-Srcset (URI)","change":"new","default_action":null,"published_on":"2025-04-28","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200101914 \"Angular.js attribute ng-Attr-Srcset (URI)\" (Cross Site Scripting (XSS), risk High), systems: System Independent, AngularJS. References: CVE-2024-8372.","first_seen_at":"2026-11-02T21:00:26.482Z"},{"id":"0858543e18be773dc2ae3734165cf13b4ea381c6c4a732052185d50b3ba7ce09","cve_id":"CVE-2024-8372","vendor":"f5","product":"Attack signatures","rule_id":"200101915","rule_name":"Angular.js attribute ng-Prop-Srcset (Parameter)","change":"new","default_action":null,"published_on":"2025-04-28","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200101915 \"Angular.js attribute ng-Prop-Srcset (Parameter)\" (Cross Site Scripting (XSS), risk High), systems: System Independent, AngularJS. References: CVE-2024-8372.","first_seen_at":"2026-11-02T21:00:26.482Z"},{"id":"a4805c55e7cc506f4a285c78a8f225d9aebbe96dc283dfe9e790be6b1d1a20c3","cve_id":"CVE-2024-8372","vendor":"f5","product":"Attack signatures","rule_id":"200101916","rule_name":"Angular.js attribute ng-Prop-Srcset (Header)","change":"new","default_action":null,"published_on":"2025-04-28","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200101916 \"Angular.js attribute ng-Prop-Srcset (Header)\" (Cross Site Scripting (XSS), risk High), systems: System Independent, AngularJS. References: CVE-2024-8372.","first_seen_at":"2026-11-02T21:00:26.482Z"},{"id":"3ad3a30540f548020996d76847719c2a0b589f71e49659a25bd8dca136e69a8b","cve_id":"CVE-2024-8372","vendor":"f5","product":"Attack signatures","rule_id":"200101917","rule_name":"Angular.js attribute ng-Prop-Srcset (URI)","change":"new","default_action":null,"published_on":"2025-04-28","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200101917 \"Angular.js attribute ng-Prop-Srcset (URI)\" (Cross Site Scripting (XSS), risk High), systems: System Independent, AngularJS. References: CVE-2024-8372.","first_seen_at":"2026-11-02T21:00:26.482Z"},{"id":"2b6ae3e4db56d786503fd3c1732c8cf4f7ea172ee73f928413271bd4c2059d0a","cve_id":"CVE-2024-8372","vendor":"f5","product":"Attack signatures","rule_id":"200101909","rule_name":"Angular.js attribute ng-Srcset (Parameter)","change":"new","default_action":null,"published_on":"2025-05-22","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200101909 \"Angular.js attribute ng-Srcset (Parameter)\" (Cross Site Scripting (XSS), risk High), systems: System Independent, AngularJS. References: CVE-2024-8372.","first_seen_at":"2026-11-02T21:00:26.263Z"},{"id":"791f5208accf57a8831fe55934f698cf6a3b09d6dd94766b4b48a5885b16d993","cve_id":"CVE-2024-8372","vendor":"f5","product":"Attack signatures","rule_id":"200101910","rule_name":"Angular.js attribute ng-Srcset (Header)","change":"new","default_action":null,"published_on":"2025-05-22","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200101910 \"Angular.js attribute ng-Srcset (Header)\" (Cross Site Scripting (XSS), risk High), systems: System Independent, AngularJS. References: CVE-2024-8372.","first_seen_at":"2026-11-02T21:00:26.263Z"},{"id":"32a84c75c2a52b6fad463acd9cc87cda200199bfb838f692b506c0859a34e967","cve_id":"CVE-2024-8372","vendor":"f5","product":"Attack signatures","rule_id":"200101911","rule_name":"Angular.js attribute ng-Srcset (URI)","change":"new","default_action":null,"published_on":"2025-05-22","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200101911 \"Angular.js attribute ng-Srcset (URI)\" (Cross Site Scripting (XSS), risk High), systems: System Independent, AngularJS. References: CVE-2024-8372.","first_seen_at":"2026-11-02T21:00:26.263Z"},{"id":"6febb120393d1ac11dab38fe28e6fe371bb46c8d4aa6f760fba6f1aea54f865b","cve_id":"CVE-2024-8372","vendor":"f5","product":"Attack signatures","rule_id":"200101912","rule_name":"Angular.js attribute ng-Attr-Srcset (Parameter)","change":"new","default_action":null,"published_on":"2025-05-22","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200101912 \"Angular.js attribute ng-Attr-Srcset (Parameter)\" (Cross Site Scripting (XSS), risk High), systems: System Independent, AngularJS. References: CVE-2024-8372.","first_seen_at":"2026-11-02T21:00:26.263Z"},{"id":"28eb7f2e9f81d51935aed3c9fc33255890442abdd40bf397a60497cc86b36fc2","cve_id":"CVE-2024-8372","vendor":"f5","product":"Attack signatures","rule_id":"200101913","rule_name":"Angular.js attribute ng-Attr-Srcset (Header)","change":"new","default_action":null,"published_on":"2025-05-22","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200101913 \"Angular.js attribute ng-Attr-Srcset (Header)\" (Cross Site Scripting (XSS), risk High), systems: System Independent, AngularJS. References: CVE-2024-8372.","first_seen_at":"2026-11-02T21:00:26.263Z"},{"id":"d6c7a2ee6eeaa30da6134f89ea4041122ffb018a7c118232da30edb092e17550","cve_id":"CVE-2024-8372","vendor":"f5","product":"Attack signatures","rule_id":"200101914","rule_name":"Angular.js attribute ng-Attr-Srcset (URI)","change":"new","default_action":null,"published_on":"2025-05-22","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200101914 \"Angular.js attribute ng-Attr-Srcset (URI)\" (Cross Site Scripting (XSS), risk High), systems: System Independent, AngularJS. References: CVE-2024-8372.","first_seen_at":"2026-11-02T21:00:26.263Z"},{"id":"48c2cb0176a979daf81bbb5fb8240443f640c3635fefb150fbc5b78c76f32de5","cve_id":"CVE-2024-8372","vendor":"f5","product":"Attack signatures","rule_id":"200101915","rule_name":"Angular.js attribute ng-Prop-Srcset (Parameter)","change":"new","default_action":null,"published_on":"2025-05-22","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200101915 \"Angular.js attribute ng-Prop-Srcset (Parameter)\" (Cross Site Scripting (XSS), risk High), systems: System Independent, AngularJS. References: CVE-2024-8372.","first_seen_at":"2026-11-02T21:00:26.263Z"},{"id":"8a57c3b90f9d47b2c4a40e1e9a19831e8ddfc0cbd5a50edc613d1917f764ea81","cve_id":"CVE-2024-8372","vendor":"f5","product":"Attack signatures","rule_id":"200101916","rule_name":"Angular.js attribute ng-Prop-Srcset (Header)","change":"new","default_action":null,"published_on":"2025-05-22","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200101916 \"Angular.js attribute ng-Prop-Srcset (Header)\" (Cross Site Scripting (XSS), risk High), systems: System Independent, AngularJS. References: CVE-2024-8372.","first_seen_at":"2026-11-02T21:00:26.263Z"},{"id":"e595402cd1f643fbc251ce567348e88e260d8b1727fe266409731ffcc579e7ab","cve_id":"CVE-2024-8372","vendor":"f5","product":"Attack signatures","rule_id":"200101917","rule_name":"Angular.js attribute ng-Prop-Srcset (URI)","change":"new","default_action":null,"published_on":"2025-05-22","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200101917 \"Angular.js attribute ng-Prop-Srcset (URI)\" (Cross Site Scripting (XSS), risk High), systems: System Independent, AngularJS. References: CVE-2024-8372.","first_seen_at":"2026-11-02T21:00:26.263Z"}]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-02T21:17:16.726Z","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial"},"measured":[],"social":{"total":0,"first_seen":null,"daily":[{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":0},{"day":"2026-11-03","posts":0}],"top_posts":[],"exploit_repositories":[]}}