PT-2019-5794 · Apache Cordova · Cordova-Plugin-Inappbrowser

Published 2019-11-27 · Updated 2022-07-25 · CVE-2019-0219

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions cordova-plugin-inappbrowser versions prior to 3.1.0

Description The issue is related to the Cordova In-App-Browser extension for Android, where a lack of protection for the web page structure can be exploited. This allows a remote attacker to execute arbitrary JavaScript code using a specially crafted URI containing the "gap-iab:" scheme. A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview.

Recommendations Upgrade to version 3.1.0 or later. As a temporary workaround, consider restricting the use of the gap-iab: scheme in the InAppBrowser webview to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2021-02406

CVE-2019-0219

GHSA-C6PW-Q7F2-97HV

Affected Products

Cordova-Plugin-Inappbrowser

References · 14

• https://oracle.com//security-alerts/cpujul2021.html · Patch
• https://oracle.com/security-alerts/cpuApr2021.html · Patch
• https://lists.apache.org/thread.html/197482d5ab80c0bff4a5ec16e1b0466df38389d9a4b5331d777f14fc%40%3Cdev.cordova.apache.org%3E · Vendor Advisory
• https://lists.apache.org/thread/4vtg0trdrh5203dktt4f3vkd5z2d5ndj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-0219 · Security Note
• https://bdu.fstec.ru/vul/2021-02406 · Security Note
• https://osv.dev/vulnerability/CVE-2019-0219 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c6pw-q7f2-97hv · Vendor Advisory
• https://openwall.com/lists/oss-security/2019/11/28/1 · Note
• http://openwall.com/lists/oss-security/2019/11/28/1 · Note
• https://t.me/cvenotify/27030 · Telegram Post
• https://npmjs.com/advisories/1467 · Note
• https://oracle.com/security-alerts/cpuapr2021.html · Note
• https://oracle.com/security-alerts/cpujul2022.html · Note