|
[Japanese]
|
JVNDB-2016-000059
|
Apache Cordova vulnerable to arbitrary plugin execution
|
|
Apache Cordova contains a vulnerability where arbitrary plugins may be executed.
Apache Cordova provided by the Apache Software Foundation is a framework for creating mobile applications for various platforms.
iOS applications built using Apache Cordova contain a vulnerability where arbitrary plugins may be executed.
Muneaki Nishimura (nishimunea) of Recruit Technologies Co.,Ltd. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
|
|
CVSS V3 Severity:
Base Metrics 6.3 (Medium) [IPA Score]
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
CVSS V2 Severity:
Base Metrics 6.8 (Medium) [IPA Score]
- Access Vector: Network
- Access Complexity: Medium
- Authentication: None
- Confidentiality Impact: Partial
- Integrity Impact: Partial
- Availability Impact: Partial
|
|
|
Apache Software Foundation
- Apache Cordova iOS versions 3.9.2 and earlier
|
|
|
Accessing a specially crafted URL may result in arbitrary plugin execution.
|
|
[Update Apache Cordova and re-build the iOS application]
Developers of iOS applications should update Apache Cordova to version 4.0.0 or later and re-build the application.
|
|
Apache Software Foundation
|
|
- Improper Input Validation(CWE-20) [IPA Evaluation]
|
|
- CVE-2015-5208
|
|
- JVN : JVN#41772178
- National Vulnerability Database (NVD) : CVE-2015-5208
|
|
- [2016/05/11]
Web page was published
[2016/06/01]
References : Content was added
|
