« Volver al listado

CVE-2024-33665

Estado: AplazadaMedia (6.1)—

angular-translate through 2.19.1 allows XSS via a crafted key that is used by the translate directive. NOTE: the vendor indicates that there is no documentation indicating that a key is supposed to be safe against XSS attacks.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Angular-translate — Angular-translateAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-33665",
  "cveTags": [
    {
      "tags": [
        "disputed"
      ],
      "sourceIdentifier": "cve@mitre.org"
    }
  ],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-33665",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-20T13:48:12.449487Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-04-26T01:15:46.100",
  "references": [
    {
      "url": "http://docs.herodevs.com/docs/2024-Angular-Translate-XSS",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/angular-translate/angular-translate/issues/1418",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/angular-translate/angular-translate/issues/1418#issuecomment-252498855",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://stackblitz.com/github/neverendingsupport/angular-translate-xss-2024?file=public%2Findex.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://docs.herodevs.com/docs/2024-Angular-Translate-XSS",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/angular-translate/angular-translate/issues/1418",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/angular-translate/angular-translate/issues/1418#issuecomment-252498855",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://stackblitz.com/github/neverendingsupport/angular-translate-xss-2024?file=public%2Findex.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "angular-translate through 2.19.1 allows XSS via a crafted key that is used by the translate directive. NOTE: the vendor indicates that there is no documentation indicating that a key is supposed to be safe against XSS attacks."
    },
    {
      "lang": "es",
      "value": "angular-translate hasta 2.19.1 permite XSS a través de una clave manipulada que utiliza la directiva de traducción. NOTA: el proveedor indica que no existe documentación que indique que una clave deba ser segura contra ataques XSS."
    }
  ],
  "lastModified": "2026-06-17T07:32:11.630",
  "sourceIdentifier": "cve@mitre.org"
}