CVE-2014-0072 ios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin (org.apache.cordova.file-transfer) before 0.4.2 for iOS and the File-Transfer plugin for iOS from Cordova 2.4.0 through 2.9....
HighCVSS 7.5
EPSS 7.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
ios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin (org.apache.cordova.file-transfer) before 0.4.2 for iOS and the File-Transfer plugin for iOS from Cordova 2.4.0 through 2.9.0 might allow remote attackers to spoof SSL servers by leveraging a default value of true for the trustAllHosts option.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache cordova file transfer | <= 0.4.1 | No fix listed |
| apache cordova | >= 2.4.0, <= 2.9.0 | No fix listed |
References
- d3adend.org issue-tracking third-party-advisory
- 20140304 [CVE-2014-0072] Apache Cordova File-Transfer insecure defaults mailing-list third-party-advisory
- 20140304 [CVE-2014-0072] Apache Cordova File-Transfer insecure defaults mailing-list
- apache-cordova-cve20140072-weak-security(91561) issue-tracking third-party-advisory vdb-entry
- github.com issue-tracking patch vendor-advisory
- [cordova-dev] 20140304 [CVE-2014-0072] Apache Cordova File-Transfer insecure defaults mailing-list