CVE-2015-8320 Apache Cordova-Android before 3.7.0 improperly generates random values for BridgeSecret data, which makes it easier for attackers to conduct bridge hijacking attacks by predicting a value.
MediumCVSS 5.0
EPSS 4.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Apache Cordova-Android before 3.7.0 improperly generates random values for BridgeSecret data, which makes it easier for attackers to conduct bridge hijacking attacks by predicting a value.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache cordova | <= 3.6.4 | No fix listed |
References
- packetstormsecurity.com
- 20151120 Fwd: CVE-2015-5257 - Weak Randomization of BridgeSecret for Apache Cordova Android mailing-list
- 77679 vdb-entry
- cordova.apache.org vendor-advisory