Detections
Analytics

SCA: security update for angular-server-side-configuration (GHSA-gwvm-vrp4-4pp5)

high Tenable Cloud Security Plugin ID 415361

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - angular-server-side-configuration helps configure an angular application at runtime on the server or in a
 docker container via environment variables. angular-server-side-configuration detects used environment
 variables in TypeScript (.ts) files during build time of an Angular CLI project. The detected environment
 variables are written to a ngssc.json file in the output directory. During deployment of an Angular based
 app, the environment variables based on the variables from ngssc.json are inserted into the apps
 index.html (or defined index file). With version 15.0.0 the environment variable detection was widened to
 the entire project, relative to the angular.json file from the Angular CLI. In a monorepo setup, this
 could lead to environment variables intended for a backend/service to be detected and written to the
 ngssc.json, which would then be populated and exposed via index.html. This has NO IMPACT, in a plain
 Angular project that has no backend component. This vulnerability has been mitigated in version 15.1.0, by
 adding an option `searchPattern` which restricts the detection file range by default. As a workaround,
 manually edit or create ngssc.json or run script after ngssc.json generation. (CVE-2023-28444)

See Also

https://github.com/advisories/GHSA-gwvm-vrp4-4pp5

Plugin Details

Severity: High

ID: 415361

Version: Revision 1.7

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.51

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2023-28444

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 3/24/2023

Vulnerability Publication Date: 3/24/2023

Reference Information

CVE: CVE-2023-28444