Vulnerability Description
The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin (org.apache.cordova.inappbrowser) before 0.3.2 for iOS and the In-App-Browser plugin for iOS from Cordova 2.6.0 through 2.9.0 does not properly validate callback identifiers, which allows remote attackers to execute arbitrary JavaScript in the host page and consequently gain privileges via a crafted gap-iab: URI.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Cordova In-App-Browser | <= 0.3.1 |
| Apache | Cordova | >= 2.6.0, <= 2.9.0 |
Related Weaknesses (CWE)
References
- http://d3adend.org/blog/?p=403Issue TrackingThird Party Advisory
- http://seclists.org/fulldisclosure/2014/Mar/30Mailing ListThird Party Advisory
- http://www.securityfocus.com/archive/1/531334/100/0/threaded
- http://www.securityfocus.com/bid/65959Third Party AdvisoryVDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/91560Issue TrackingThird Party AdvisoryVDB Entry
- https://github.com/apache/cordova-plugin-inappbrowser/commit/26702cb0720c5c394b4Issue TrackingPatchVendor Advisory
- https://mail-archives.apache.org/mod_mbox/cordova-dev/201403.mbox/%3CCAK_TSXLGJa
- http://d3adend.org/blog/?p=403Issue TrackingThird Party Advisory
- http://seclists.org/fulldisclosure/2014/Mar/30Mailing ListThird Party Advisory
- http://www.securityfocus.com/archive/1/531334/100/0/threaded
- http://www.securityfocus.com/bid/65959Third Party AdvisoryVDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/91560Issue TrackingThird Party AdvisoryVDB Entry
- https://github.com/apache/cordova-plugin-inappbrowser/commit/26702cb0720c5c394b4Issue TrackingPatchVendor Advisory
- https://mail-archives.apache.org/mod_mbox/cordova-dev/201403.mbox/%3CCAK_TSXLGJa
FAQ
What is CVE-2014-0073?
CVE-2014-0073 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin (org.apache.cordova.inappbrowser) before 0.3.2 for iOS and the In-App-Browser plugin for iOS from Cordova 2.6.0 through...
How severe is CVE-2014-0073?
CVE-2014-0073 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2014-0073?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Cordova In-App-Browser, Apache Cordova.