PT-2016-3671 · Apache · Apache Cordova

Muneaki Nishimura + 1 · Published 2016-05-09 · Updated 2018-10-09 · CVE-2015-5207

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache Cordova iOS versions prior to 4.0.0

Description The issue allows attackers to bypass a URL whitelist protection mechanism in an app and load arbitrary resources by leveraging unspecified methods.

Recommendations For versions prior to 4.0.0, update to version 4.0.0 or later to resolve the issue.

Fix

Improper Access Control

Weakness Enumeration

CWE-254

CWE-284

Related Identifiers

CVE-2015-5207

Affected Products

Apache Cordova

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2015-5207 · Security Note
• https://cordova.apache.org/announcements/2016/04/27/security.html · Vendor Advisory
• http://securityfocus.com/bid/88764 · Note
• http://packetstormsecurity.com/files/136840/Apache-Cordova-iOS-3.9.1-Access-Bypass.html · Note
• http://securityfocus.com/archive/1/538211/100/0/threaded · Note
• http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000058.html · Note
• http://jvn.jp/en/jp/JVN35341085/index.html · Note