|
[Japanese]
|
JVNDB-2016-000058
|
Apache Cordova fails to restrict access permissions
|
|
Apache Cordova contains a vulnerability where whitelist restrictions are not properly applied.
Apache Cordova provided by the Apache Software Foundation is a framework for creating mobile applications for various platforms.
iOS applications built using Apache Cordova contain a vulnerability where whitelist restrictions are not properly applied.
Muneaki Nishimura (nishimunea) of Recruit Technologies Co.,Ltd. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
|
|
CVSS V3 Severity:
Base Metrics 4.3 (Medium) [IPA Score]
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
CVSS V2 Severity:
Base Metrics 4.3 (Medium) [IPA Score]
- Access Vector: Network
- Access Complexity: Medium
- Authentication: None
- Confidentiality Impact: None
- Integrity Impact: Partial
- Availability Impact: None
|
|
|
Apache Software Foundation
- Apache Cordova iOS versions 3.9.2 and earlier
|
|
|
Accessing a specially crafted URL may result in transitioning to a URL that the whitelist should restrict.
|
|
[Update Apache Cordova and re-build the iOS application]
Developers of iOS applications should update Apache Cordova to version 4.0.0 or later and re-build the application.
|
|
Apache Software Foundation
|
|
- Permissions(CWE-264) [IPA Evaluation]
|
|
- CVE-2015-5207
|
|
- JVN : JVN#35341085
- National Vulnerability Database (NVD) : CVE-2015-5207
|
|
- [2016/05/11]
Web page was published
[2016/06/02]
References : Content was added
|
