CVE-2015-8320

Опубликовано: 23 нояб. 2015

Источник: nvd

CVSS2: 5

EPSS Низкий

Описание

Apache Cordova-Android before 3.7.0 improperly generates random values for BridgeSecret data, which makes it easier for attackers to conduct bridge hijacking attacks by predicting a value.

Комментарий

CWE-330: Use of Insufficiently Random Values

Ссылки

http://packetstormsecurity.com/files/134496/Apache-Cordova-Android-3.6.4-BridgeSecret-Weak-Randomization.html
http://www.securityfocus.com/archive/1/536945/100/0/threaded
http://www.securityfocus.com/bid/77679
https://cordova.apache.org/announcements/2015/11/20/security.html
Vendor Advisory
http://packetstormsecurity.com/files/134496/Apache-Cordova-Android-3.6.4-BridgeSecret-Weak-Randomization.html
http://www.securityfocus.com/archive/1/536945/100/0/threaded
http://www.securityfocus.com/bid/77679
https://cordova.apache.org/announcements/2015/11/20/security.html
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:apache:cordova:*:*:*:*:*:android:*:*

Версия до 3.6.4 (включая)

EPSS

Процентиль: 85%

0.02562

Низкий

5 Medium

CVSS2

Дефекты

NVD-CWE-Other

Связанные уязвимости

GHSA-87x6-r7ff-7gv7

github

больше 3 лет назад