CVE-2017-3160 After the Android platform is added to Cordova the first time, or after a project is created using the build scripts, the scripts will fetch Gradle on the first build. However, since the default URI i...
- Published
- Updated
- Exploit status
- No public exploit known
Description
After the Android platform is added to Cordova the first time, or after a project is created using the build scripts, the scripts will fetch Gradle on the first build. However, since the default URI is not using https, it is vulnerable to a MiTM and the Gradle executable is not safe. The severity of this issue is high due to the fact that the build scripts immediately start a build after Gradle has been fetched. Developers who are concerned about this issue should install version 6.1.2 or higher of Cordova-Android. If developers are unable to install the latest version, this vulnerability can easily be mitigated by setting the CORDOVA_ANDROID_GRADLE_DISTRIBUTION_URL environment variable to https://services.gradle.org/distributions/gradle-2.14.1-all.zip
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache cordova | < 6.1.2 | 6.1.2 |
| Apache Cordova Android | = Apache Cordova 6.1.0 and below | No fix listed |
References
- 95838 third-party-advisory vdb-entry
- cordova.apache.org mitigation vendor-advisory
- www.oracle.com