angular-server-side-configuration information disclosure vulnerability in monorepo with node.js backend

Description

angular-server-side-configuration detects used environment variables in TypeScript (.ts) files during build time of an Angular CLI project. The detected environment variables are written to a ngssc.json file in the output directory. During deployment of an Angular based app, the environment variables based on the variables from ngssc.

Recommendation

Update the angular-server-side-configuration package to the latest compatible version. Followings are version details:

• Affected version(s): >= 15.0.0, < 15.1.0
• Patched version(s): 15.1.0

References

• GHSA-gwvm-vrp4-4pp5
• CVE-2023-28444
• CWE-200
• CWE-538
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• matrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged rooms - CVE-2023-38700
• Redwood is vulnerable to account takeover via dbAuth "forgot-password - Vulnerability
• Parse Server before v3.4.1 vulnerable to Denial of Service - CVE-2019-1020012
• Incorrect default cookie name and recommendation - Vulnerability

Tags:

npm

angular-server-side-configuration