CVE-2014-1883 Adobe PhoneGap before 2.6.0 on Android uses the shouldOverrideUrlLoading callback instead of the proper shouldInterceptRequest callback, which allows remote attackers to bypass intended device-resourc...
HighCVSS 7.5
EPSS 4.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Adobe PhoneGap before 2.6.0 on Android uses the shouldOverrideUrlLoading callback instead of the proper shouldInterceptRequest callback, which allows remote attackers to bypass intended device-resource restrictions via content that is accessed (1) in an IFRAME element or (2) with the XMLHttpRequest method by a crafted application.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Adobe phonegap | <= 2.5.0 | No fix listed |
| Adobe phonegap | = 2.0.0 | No fix listed |
| Adobe phonegap | = 2.0.0-rc1 | No fix listed |
| Adobe phonegap | = 2.1.0 | No fix listed |
| Adobe phonegap | = 2.2.0 | No fix listed |
| Adobe phonegap | = 2.2.0-rc1 | No fix listed |
| Adobe phonegap | = 2.2.0-rc2 | No fix listed |
| Adobe phonegap | = 2.3.0 | No fix listed |
| Adobe phonegap | = 2.3.0-rc1 | No fix listed |
| Adobe phonegap | = 2.3.0-rc2 | No fix listed |
| Adobe phonegap | = 2.4.0 | No fix listed |
| Adobe phonegap | = 2.4.0-rc1 | No fix listed |
| Adobe phonegap | = 2.5.0-rc1 | No fix listed |