PT-2017-6525 · Apache · Apache Cordova Android

Seven She · Publicado 2017-10-27 · Atualizado 2017-11-16 · CVE-2015-1835

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache Cordova Android versions prior to 3.7.2 Apache Cordova Android 4.x versions prior to 4.0.2

Description The issue allows remote attackers to modify undefined secondary configuration variables (preferences) via a crafted intent: URL, when an application does not set explicit values in config.xml.

Recommendations For Apache Cordova Android versions prior to 3.7.2, update to version 3.7.2 or later. For Apache Cordova Android 4.x versions prior to 4.0.2, update to version 4.0.2 or later.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2015-1835

Produtos afetados

Apache Cordova Android

Referências · 4

• 🔥 http://blog.trendmicro.com/trendlabs-security-intelligence/trend-micro-discovers-apache-vulnerability-that-allows-one-click-modification-of-android-apps · Exploit
• https://cordova.apache.org/announcements/2015/05/26/android-402.html · Aviso do Fabricante
• http://securityfocus.com/bid/74866 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-1835 · Nota de Segurança