PT-2020-21585 · Apache · Cordova-Plugin-China-Picker

Published 2020-09-01 · Updated 2020-09-01

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions cordova-plugin-china-picker version 1.0.910

Description The issue concerns malicious code in version 1.0.910 of cordova-plugin-china-picker. When executed in a browser, this code enumerates sensitive fields such as password, cvc, and cardnumber from forms and sends the extracted values to the endpoint "https://js-metrics.com/minjs.php?pl=".

Recommendations Replace version 1.0.910 of cordova-plugin-china-picker with a version before or after 1.0.910. Evaluate your application to determine whether user data was compromised.

Fix

RCE

Weakness Enumeration

CWE-506

Related Identifiers

GHSA-X9GM-QXHH-RF75

Affected Products

Cordova-Plugin-China-Picker

References · 5

• https://osv.dev/vulnerability/GHSA-x9gm-qxhh-rf75 · Vendor Advisory
• https://snyk.io/vuln/SNYK-JS-CORDOVAPLUGINCHINAPICKER-451001 · Note
• https://npmjs.com/advisories/622 · Note
• https://github.com/advisories/GHSA-x9gm-qxhh-rf75 · Note
• https://git.oschina.net/BlankTrack/ChinaPicker.git · Note