PT-2017-6525 · Apache · Apache Cordova Android

Seven She · Published 2017-10-27 · Updated 2017-11-16 · CVE-2015-1835

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache Cordova Android versions prior to 3.7.2 Apache Cordova Android 4.x versions prior to 4.0.2

Description The issue allows remote attackers to modify undefined secondary configuration variables (preferences) via a crafted intent: URL, when an application does not set explicit values in config.xml.

Recommendations For Apache Cordova Android versions prior to 3.7.2, update to version 3.7.2 or later. For Apache Cordova Android 4.x versions prior to 4.0.2, update to version 4.0.2 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2015-1835

Affected Products

Apache Cordova Android

References · 4

• 🔥 http://blog.trendmicro.com/trendlabs-security-intelligence/trend-micro-discovers-apache-vulnerability-that-allows-one-click-modification-of-android-apps · Exploit
• https://cordova.apache.org/announcements/2015/05/26/android-402.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-1835 · Security Note
• http://securityfocus.com/bid/74866 · Note