PT-2018-9299 · Ionic Team · Cordova

R3Ggi · Published 2018-03-13 · Updated 2018-04-16 · CVE-2018-1000123

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Ionic Team Cordova plugin iOS Keychain versions before commit 18233ca25dfa92cca018b9c0935f43f78fd77fbf

Description: The issue is related to an Information Exposure Through Log Files, which can lead to the leakage of sensitive data such as login credentials and passwords. This can be exploited if an attacker has access to the victim's iOS logs.

Recommendations: For versions before commit 18233ca25dfa92cca018b9c0935f43f78fd77fbf, update to a version after commit 18233ca25dfa92cca018b9c0935f43f78fd77fbf to resolve the issue. As a temporary workaround, consider restricting access to iOS logs to minimize the risk of exploitation.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2018-1000123

Affected Products

Cordova

References · 3

• https://github.com/ionic-team/cordova-plugin-ios-keychain/pull/29/commits/980230645c8ea3b531b85401de5e4bca0f860e42#diff-936020291e4c2115faff0171f20672a4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000123 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1000123 · Vendor Advisory