Lucene search

[email protected]CVE-2012-6637

HistoryMar 03, 2014 - 4:50 a.m.

CVE-2012-6637

2014-03-0304:50:00

CWE-20

[email protected]

web.nvd.nist.gov

cve-2012-6637

apache cordova

adobe phonegap

remote attack

whitelist bypass

6.8 Medium

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.006 Low

EPSS

Percentile

78.9%

JSON

Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier do not anchor the end of domain-name regular expressions, which allows remote attackers to bypass a whitelist protection mechanism via a domain name that contains an acceptable name as an initial substring.

CPENameOperatorVersion
apache:cordovaapache cordovaeq3.0.0
apache:cordovaapache cordovaeq3.1.0
apache:cordovaapache cordovale3.3.0
apache:cordovaapache cordovaeq3.2.0
adobe:phonegapadobe phonegapeq2.1.0
adobe:phonegapadobe phonegapeq2.2.0
adobe:phonegapadobe phonegapeq2.0.0
adobe:phonegapadobe phonegaple2.9.0
adobe:phonegapadobe phonegapeq2.7.0
adobe:phonegapadobe phonegapeq2.3.0

CPE	Name	Operator	Version
apache:cordova	apache cordova	eq	3.0.0
apache:cordova	apache cordova	eq	3.1.0
apache:cordova	apache cordova	le	3.3.0
apache:cordova	apache cordova	eq	3.2.0
adobe:phonegap	adobe phonegap	eq	2.1.0
adobe:phonegap	adobe phonegap	eq	2.2.0
adobe:phonegap	adobe phonegap	eq	2.0.0
adobe:phonegap	adobe phonegap	le	2.9.0
adobe:phonegap	adobe phonegap	eq	2.7.0
adobe:phonegap	adobe phonegap	eq	2.3.0

Rows per page:

1-10 of 151

References

labs.mwrinfosecurity.com/blog/2012/04/30/building-android-javajavascript-bridges/

openwall.com/lists/oss-security/2014/02/07/9

packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt

seclists.org/bugtraq/2014/Jan/96

www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf

www.internetsociety.org/ndss2014/programme#session3

6.8 Medium

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.006 Low

EPSS

Percentile

78.9%

JSON

Related for CVE-2012-6637

cvelist1 veracode1 prion1 ubuntucve1