PT-2018-9299 · Ionic Team · Cordova

R3Ggi · Publicado 2018-03-13 · Atualizado 2018-04-16 · CVE-2018-1000123

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Ionic Team Cordova plugin iOS Keychain versions before commit 18233ca25dfa92cca018b9c0935f43f78fd77fbf

Description: The issue is related to an Information Exposure Through Log Files, which can lead to the leakage of sensitive data such as login credentials and passwords. This can be exploited if an attacker has access to the victim's iOS logs.

Recommendations: For versions before commit 18233ca25dfa92cca018b9c0935f43f78fd77fbf, update to a version after commit 18233ca25dfa92cca018b9c0935f43f78fd77fbf to resolve the issue. As a temporary workaround, consider restricting access to iOS logs to minimize the risk of exploitation.

Correção

Insertion into Log File

Enumeração de Fraquezas

CWE-532

Identificadores relacionados

CVE-2018-1000123

Produtos afetados

Cordova

Referências · 3

• https://github.com/ionic-team/cordova-plugin-ios-keychain/pull/29/commits/980230645c8ea3b531b85401de5e4bca0f860e42#diff-936020291e4c2115faff0171f20672a4 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000123 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-1000123 · Aviso do Fabricante