CVE-2015-1835 Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in config.xml, allows remote attackers to modify undefined secondary configuration variables....
MediumCVSS 5.3
EPSS 5.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in config.xml, allows remote attackers to modify undefined secondary configuration variables (preferences) via a crafted intent: URL.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache cordova | <= 3.7.1 | No fix listed |
| apache cordova | = 4.0.0 | No fix listed |
| apache cordova | = 4.0.1 | No fix listed |
References
- blog.trendmicro.com exploit technical-description third-party-advisory
- 74866 third-party-advisory vdb-entry
- cordova.apache.org release-notes vendor-advisory