CVE-2012-6637 Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier do not anchor the end of domain-name regular expressions, which allows remote attackers to bypass a whitelist protection mechanism...
HighCVSS 7.5
EPSS 8.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier do not anchor the end of domain-name regular expressions, which allows remote attackers to bypass a whitelist protection mechanism via a domain name that contains an acceptable name as an initial substring.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache cordova | <= 3.3.0 | No fix listed |
| apache cordova | = 3.0.0 | No fix listed |
| apache cordova | = 3.0.0-rc1 | No fix listed |
| apache cordova | = 3.1.0 | No fix listed |
| apache cordova | = 3.1.0-rc1 | No fix listed |
| apache cordova | = 3.2.0 | No fix listed |
| apache cordova | = 3.2.0-rc1 | No fix listed |
| apache cordova | = 3.3.0-rc1 | No fix listed |
| Adobe phonegap | <= 2.9.0 | No fix listed |
| Adobe phonegap | = 2.0.0 | No fix listed |
| Adobe phonegap | = 2.0.0-rc1 | No fix listed |
| Adobe phonegap | = 2.1.0 | No fix listed |
| Adobe phonegap | = 2.2.0 | No fix listed |
| Adobe phonegap | = 2.2.0-rc1 | No fix listed |
| Adobe phonegap | = 2.2.0-rc2 | No fix listed |
| Adobe phonegap | = 2.3.0 | No fix listed |
| Adobe phonegap | = 2.3.0-rc1 | No fix listed |
| Adobe phonegap | = 2.3.0-rc2 | No fix listed |
| Adobe phonegap | = 2.4.0 | No fix listed |
| Adobe phonegap | = 2.4.0-rc1 | No fix listed |
| Adobe phonegap | = 2.5.0 | No fix listed |
| Adobe phonegap | = 2.5.0-rc1 | No fix listed |
| Adobe phonegap | = 2.6.0 | No fix listed |
| Adobe phonegap | = 2.6.0-rc1 | No fix listed |
| Adobe phonegap | = 2.7.0 | No fix listed |
Show 4 more
| Product | Affected versions | Fixed in |
|---|---|---|
| Adobe phonegap | = 2.7.0-rc1 | No fix listed |
| Adobe phonegap | = 2.8.0 | No fix listed |
| Adobe phonegap | = 2.8.1 | No fix listed |
| Adobe phonegap | = 2.9.0-rc1 | No fix listed |