Code injection

2014-03-0304:50:00

PRIOn knowledge base

www.prio-n.com

7.2 High

AI Score

Confidence

Low

0.02 Low

EPSS

Percentile

88.8%

JSON

Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-resource restrictions of an event-based bridge via a crafted library clone that leverages IFRAME script execution and waits a certain amount of time for an OnJsPrompt handler return value as an alternative to correct synchronization.

CPENameOperatorVersion
phonegapeq2.1.0
phonegapeq2.2.0 rc1
phonegapeq2.0.0
phonegaple2.9.0
phonegapeq2.7.0 rc1
phonegapeq2.3.0
phonegapeq2.6.0
phonegapeq2.2.0
phonegapeq2.0.0 rc1
phonegapeq2.2.0 rc2

Name	Operator	Version
phonegap	eq	2.1.0
phonegap	eq	2.2.0 rc1
phonegap	eq	2.0.0
phonegap	le	2.9.0
phonegap	eq	2.7.0 rc1
phonegap	eq	2.3.0
phonegap	eq	2.6.0
phonegap	eq	2.2.0
phonegap	eq	2.0.0 rc1
phonegap	eq	2.2.0 rc2