CVE-2014-0073

Publicada em 30 out 2017 · Atualizada em 06 ago 2024

3Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackepss 8.3%

probabilidade de exploração

8.3%top 5% das CVEs

exploração observada

nãonenhuma fonte reporta

The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin (org.apache.cordova.inappbrowser) before 0.3.2 for iOS and the In-App-Browser plugin for iOS from Cordova 2.6.0 through 2.9.0 does not properly validate callback identifiers, which allows remote attackers to execute arbitrary JavaScript in the host page and consequently gain privileges via a crafted gap-iab: URI.

Produtos afetados

n/a · n/a

Referências

http://d3adend.org/blog/?p=403 http://seclists.org/fulldisclosure/2014/Mar/30 https://exchange.xforce.ibmcloud.com/vulnerabilities/91560 https://github.com/apache/cordova-plugin-inappbrowser/commit/26702cb0720c5c394b407c23570136c53171fa55 https://mail-archives.apache.org/mod_mbox/cordova-dev/201403.mbox/%3CCAK_TSXLGJag5Q9ATUCbFtkWvMWX9XnC80kKp-HKi25gPcvV4gw%40mail.gmail.com%3E http://www.securityfocus.com/archive/1/531334/100/0/threaded http://www.securityfocus.com/bid/65959