CVE-2014-1882 Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-resource restrictions of an event-based bridge via a crafted library clone that l...
HighCVSS 7.5
EPSS 11.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-resource restrictions of an event-based bridge via a crafted library clone that leverages IFRAME script execution and directly accesses bridge JavaScript objects, as demonstrated by certain cordova.require calls.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Adobe phonegap | <= 2.9.0 | No fix listed |
| Adobe phonegap | = 2.0.0 | No fix listed |
| Adobe phonegap | = 2.0.0-rc1 | No fix listed |
| Adobe phonegap | = 2.1.0 | No fix listed |
| Adobe phonegap | = 2.2.0 | No fix listed |
| Adobe phonegap | = 2.2.0-rc1 | No fix listed |
| Adobe phonegap | = 2.2.0-rc2 | No fix listed |
| Adobe phonegap | = 2.3.0 | No fix listed |
| Adobe phonegap | = 2.3.0-rc1 | No fix listed |
| Adobe phonegap | = 2.3.0-rc2 | No fix listed |
| Adobe phonegap | = 2.4.0 | No fix listed |
| Adobe phonegap | = 2.4.0-rc1 | No fix listed |
| Adobe phonegap | = 2.5.0 | No fix listed |
| Adobe phonegap | = 2.5.0-rc1 | No fix listed |
| Adobe phonegap | = 2.6.0 | No fix listed |
| Adobe phonegap | = 2.6.0-rc1 | No fix listed |
| Adobe phonegap | = 2.7.0 | No fix listed |
| Adobe phonegap | = 2.7.0-rc1 | No fix listed |
| Adobe phonegap | = 2.8.0 | No fix listed |
| Adobe phonegap | = 2.8.1 | No fix listed |
| Adobe phonegap | = 2.9.0-rc1 | No fix listed |
| apache cordova | <= 3.3.0 | No fix listed |
| apache cordova | = 3.0.0 | No fix listed |
| apache cordova | = 3.0.0-rc1 | No fix listed |
| apache cordova | = 3.1.0 | No fix listed |
Show 4 more
| Product | Affected versions | Fixed in |
|---|---|---|
| apache cordova | = 3.1.0-rc1 | No fix listed |
| apache cordova | = 3.2.0 | No fix listed |
| apache cordova | = 3.2.0-rc1 | No fix listed |
| apache cordova | = 3.3.0-rc1 | No fix listed |