Lucene search

[email protected]CVE-2017-3160

HistoryFeb 01, 2018 - 9:29 p.m.

CVE-2017-3160

2018-02-0121:29:00

[email protected]

web.nvd.nist.gov

android

cordova

platform

vulnerability

mitm

attack

gradle

fetch

security

nvd

7.4 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

7.2 High

AI Score

Confidence

High

5.8 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

0.001 Low

EPSS

Percentile

33.1%

JSON

After the Android platform is added to Cordova the first time, or after a project is created using the build scripts, the scripts will fetch Gradle on the first build. However, since the default URI is not using https, it is vulnerable to a MiTM and the Gradle executable is not safe. The severity of this issue is high due to the fact that the build scripts immediately start a build after Gradle has been fetched. Developers who are concerned about this issue should install version 6.1.2 or higher of Cordova-Android. If developers are unable to install the latest version, this vulnerability can easily be mitigated by setting the CORDOVA_ANDROID_GRADLE_DISTRIBUTION_URL environment variable to https://services.gradle.org/distributions/gradle-2.14.1-all.zip

Affected configurations

Vulners

NVD

Node

apachecordovaRange≤6.1.0

CPENameOperatorVersion
apache:cordovaapache cordovalt6.1.2

CPE	Name	Operator	Version
apache:cordova	apache cordova	lt	6.1.2

CNA Affected

[
  {
    "product": "Apache Cordova Android",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "status": "affected",
        "version": "Apache Cordova 6.1.0 and below"
      }
    ]
  }
]