Security readout for executives and security teams
Plain-English summary
This is a medium-severity cross-site scripting issue in AngularJS package distributions. The reported trigger depends on Internet Explorer page caching and user interaction, so business urgency is highest for legacy applications still reachable through IE or IE compatibility modes.
Executive priority
Address during normal vulnerability remediation, with escalation for public legacy apps or regulated workflows still dependent on IE. This is not a KEV-listed emergency based on the provided sources, but legacy AngularJS exposure should not be ignored.
Technical view
CVE-2022-25869 is CWE-79 XSS affecting listed AngularJS-related packages, including npm angular, WebJars variants, AngularJS.Core, and angularjs. The source describes insecure Internet Explorer page caching that can allow interpolation of textarea elements. CVSS 3.1 is 4.2 with high attack complexity and required user interaction.
Likely exposure
Exposure is most likely in legacy AngularJS applications that include the listed packages and are accessed with Internet Explorer or compatibility-mode browser paths. The bundle says all versions are affected, but exact fixed-version data is not provided here.
Exploitation context
The source bundle includes public proof-of-concept references, but KEV is false and no cited source states active exploitation. Exploitation requires network reachability and user interaction, with limited confidentiality and integrity impact in the provided CVSS vector.
Researcher notes
Evidence ties the issue to AngularJS package distributions and IE page caching. The bundle lists public PoC resources, but does not provide exploit telemetry, a vendor patch, or precise fixed versions. Avoid assuming modern Angular products beyond the named packages.
Mitigation direction
- Inventory use of angular, angularjs, AngularJS.Core, and listed WebJars packages.
- Check Snyk and vendor/package guidance for supported remediation or replacement direction.
- Prioritize legacy apps still supporting Internet Explorer or compatibility modes.
- Reduce exposure of affected legacy AngularJS pages until guidance is confirmed.
- Treat remediation as dependency modernization if no fixed version exists.
Validation and detection
- Search dependency manifests for the listed package names and WebJars coordinates.
- Identify public routes using AngularJS pages with textarea interpolation behavior.
- Confirm whether users can access those routes with Internet Explorer compatibility paths.
- Check scanners against Snyk advisories for CVE-2022-25869 coverage.
- Record any affected application owner, route, and browser support dependency.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-25869 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.2 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P1.62.5Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
4.2MediumVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P
Source materials
- CVE List V5 sourceCVE List V5
- https://security.snyk.io/vuln/SNYK-JS-ANGULAR-2949781CVE reference
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2949782CVE reference
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2949783CVE reference
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-2949784CVE reference
- https://security.snyk.io/vuln/SNYK-DOTNET-ANGULARJSCORE-6084031CVE reference
- https://security.snyk.io/vuln/SNYK-DOTNET-ANGULARJS-10771617CVE reference
- https://neverendingsupport.github.io/angularjs-poc-cve-2022-25869CVE reference
- https://snyk.io/vuln/SNYK-JS-ANGULAR-2949781CVE reference · x_refsource_MISC, x_transferred
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2949782CVE reference · x_refsource_MISC, x_transferred
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2949783CVE reference · x_refsource_MISC, x_transferred
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-2949784CVE reference · x_refsource_MISC, x_transferred
- https://glitch.com/edit/%23%21/angular-repro-textarea-xssCVE reference · x_refsource_MISC, x_transferred
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.