PT-2016-3671 · Apache · Apache Cordova

Muneaki Nishimura + 1 · Publicado 2016-05-09 · Atualizado 2018-10-09 · CVE-2015-5207

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache Cordova iOS versions prior to 4.0.0

Description The issue allows attackers to bypass a URL whitelist protection mechanism in an app and load arbitrary resources by leveraging unspecified methods.

Recommendations For versions prior to 4.0.0, update to version 4.0.0 or later to resolve the issue.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-254

CWE-284

Identificadores relacionados

CVE-2015-5207

Produtos afetados

Apache Cordova

Referências · 7

• http://securityfocus.com/bid/88764 · Nota
• http://packetstormsecurity.com/files/136840/Apache-Cordova-iOS-3.9.1-Access-Bypass.html · Nota
• http://securityfocus.com/archive/1/538211/100/0/threaded · Nota
• http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000058.html · Nota
• http://jvn.jp/en/jp/JVN35341085/index.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-5207 · Nota de Segurança
• https://cordova.apache.org/announcements/2016/04/27/security.html · Aviso do Fabricante