Lucene search

[email protected]CVE-2014-1884

HistoryMar 03, 2014 - 4:50 a.m.

CVE-2014-1884

2014-03-0304:50:46

CWE-264

[email protected]

web.nvd.nist.gov

cve-2014-1884

apache cordova

adobe phonegap

windows phone

security vulnerability

navigation event

restriction bypass

nvd

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

6.8 Medium

AI Score

Confidence

Low

0.012 Low

EPSS

Percentile

85.1%

JSON

Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier on Windows Phone 7 and 8 do not properly restrict navigation events, which allows remote attackers to bypass intended device-resource restrictions via content that is accessed (1) in an IFRAME element or (2) with the XMLHttpRequest method by a crafted application.

Affected configurations

NVD

Node

apachecordovaRange≤3.3.0

apachecordovaMatch3.0.0

apachecordovaMatch3.0.0rc1

apachecordovaMatch3.1.0

apachecordovaMatch3.1.0rc1

apachecordovaMatch3.2.0

apachecordovaMatch3.2.0rc1

apachecordovaMatch3.3.0rc1

AND

microsoftwindows_phoneMatch7

microsoftwindows_phoneMatch8

Node

adobephonegapRange≤2.9.0

adobephonegapMatch2.0.0

adobephonegapMatch2.0.0rc1

adobephonegapMatch2.1.0

adobephonegapMatch2.2.0

adobephonegapMatch2.2.0rc1

adobephonegapMatch2.2.0rc2

adobephonegapMatch2.3.0

adobephonegapMatch2.3.0rc1

adobephonegapMatch2.3.0rc2

adobephonegapMatch2.4.0

adobephonegapMatch2.4.0rc1

adobephonegapMatch2.5.0

adobephonegapMatch2.5.0rc1

adobephonegapMatch2.6.0

adobephonegapMatch2.6.0rc1

adobephonegapMatch2.7.0

adobephonegapMatch2.7.0rc1

adobephonegapMatch2.8.0

adobephonegapMatch2.8.1

adobephonegapMatch2.9.0rc1

AND

microsoftwindows_phoneMatch7

microsoftwindows_phoneMatch8

CPENameOperatorVersion
apache:cordovaapache cordovale3.3.0
apache:cordovaapache cordovaeq3.0.0
apache:cordovaapache cordovaeq3.1.0
apache:cordovaapache cordovaeq3.2.0