CVE-2015-1835

Опубликовано: 27 окт. 2017

Источник: nvd

CVSS3: 5.3

CVSS2: 2.6

EPSS Низкий

Описание

Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in config.xml, allows remote attackers to modify undefined secondary configuration variables (preferences) via a crafted intent: URL.

Ссылки

http://blog.trendmicro.com/trendlabs-security-intelligence/trend-micro-discovers-apache-vulnerability-that-allows-one-click-modification-of-android-apps/
Exploit
Technical Description
Third Party Advisory
http://www.securityfocus.com/bid/74866
Third Party Advisory
VDB Entry
https://cordova.apache.org/announcements/2015/05/26/android-402.html
Release Notes
Vendor Advisory
http://blog.trendmicro.com/trendlabs-security-intelligence/trend-micro-discovers-apache-vulnerability-that-allows-one-click-modification-of-android-apps/
Exploit
Technical Description
Third Party Advisory
http://www.securityfocus.com/bid/74866
Third Party Advisory
VDB Entry
https://cordova.apache.org/announcements/2015/05/26/android-402.html
Release Notes
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apache:cordova:*:*:*:*:*:android:*:*

Версия до 3.7.1 (включая)

cpe:2.3:a:apache:cordova:4.0.0:*:*:*:*:android:*:*

cpe:2.3:a:apache:cordova:4.0.1:*:*:*:*:android:*:*

EPSS

Процентиль: 70%

0.00625

Низкий

5.3 Medium

CVSS3

2.6 Low

CVSS2

Дефекты

CWE-20

Связанные уязвимости

GHSA-2px6-cp37-hh2h