Code injection

2014-03-0304:50:00

PRIOn knowledge base

www.prio-n.com

7.2 High

AI Score

Confidence

Low

0.029 Low

EPSS

Percentile

90.8%

JSON

Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-resource restrictions of an event-based bridge via a crafted library clone that leverages IFRAME script execution and directly accesses bridge JavaScript objects, as demonstrated by certain cordova.require calls.

CPENameOperatorVersion
phonegapeq2.1.0
phonegapeq2.2.0 rc1
phonegapeq2.0.0
phonegaple2.9.0
phonegapeq2.7.0 rc1
phonegapeq2.3.0
phonegapeq2.6.0
phonegapeq2.2.0
phonegapeq2.0.0 rc1
phonegapeq2.2.0 rc2

Name	Operator	Version
phonegap	eq	2.1.0
phonegap	eq	2.2.0 rc1
phonegap	eq	2.0.0
phonegap	le	2.9.0
phonegap	eq	2.7.0 rc1
phonegap	eq	2.3.0
phonegap	eq	2.6.0
phonegap	eq	2.2.0
phonegap	eq	2.0.0 rc1
phonegap	eq	2.2.0 rc2