Lucene search
MitreCVE-2014-1882HistoryMar 03, 2014 - 4:50 a.m.
CVE-2014-1882
2014-03-0304:50:46
CWE-264
mitre
web.nvd.nist.gov
24
cve-2014-1882
apache cordova
adobe phonegap
remote attackers
device-resource restrictions
event-based bridge
crafted library clone
iframe script execution
bridge javascript objects
cordova.require calls
CVSS2
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
AI Score
6.8
Confidence
Low
EPSS
0.029
Percentile
90.8%
Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-resource restrictions of an event-based bridge via a crafted library clone that leverages IFRAME script execution and directly accesses bridge JavaScript objects, as demonstrated by certain cordova.require calls.
Affected configurations
Node
adobephonegapRange≤2.9.0
ORadobephonegapMatch2.0.0
ORadobephonegapMatch2.0.0rc1
ORadobephonegapMatch2.1.0
ORadobephonegapMatch2.2.0
ORadobephonegapMatch2.2.0rc1
ORadobephonegapMatch2.2.0rc2
ORadobephonegapMatch2.3.0
ORadobephonegapMatch2.3.0rc1
ORadobephonegapMatch2.3.0rc2
ORadobephonegapMatch2.4.0
ORadobephonegapMatch2.4.0rc1
ORadobephonegapMatch2.5.0
ORadobephonegapMatch2.5.0rc1
ORadobephonegapMatch2.6.0
ORadobephonegapMatch2.6.0rc1
ORadobephonegapMatch2.7.0
ORadobephonegapMatch2.7.0rc1
ORadobephonegapMatch2.8.0
ORadobephonegapMatch2.8.1
ORadobephonegapMatch2.9.0rc1
Node
apachecordovaRange≤3.3.0
ORapachecordovaMatch3.0.0
ORapachecordovaMatch3.0.0rc1
ORapachecordovaMatch3.1.0
ORapachecordovaMatch3.1.0rc1
ORapachecordovaMatch3.2.0
ORapachecordovaMatch3.2.0rc1
ORapachecordovaMatch3.3.0rc1
| Vendor | Product | Version | CPE |
|---|---|---|---|
| adobe | phonegap | * | cpe:2.3:a:adobe:phonegap:*:*:*:*:*:*:*:* |
| adobe | phonegap | 2.0.0 | cpe:2.3:a:adobe:phonegap:2.0.0:*:*:*:*:*:*:* |
| adobe | phonegap | 2.0.0 | cpe:2.3:a:adobe:phonegap:2.0.0:rc1:*:*:*:*:*:* |
| adobe | phonegap | 2.1.0 | cpe:2.3:a:adobe:phonegap:2.1.0:*:*:*:*:*:*:* |
| adobe | phonegap | 2.2.0 | cpe:2.3:a:adobe:phonegap:2.2.0:*:*:*:*:*:*:* |
| adobe | phonegap | 2.2.0 | cpe:2.3:a:adobe:phonegap:2.2.0:rc1:*:*:*:*:*:* |
| adobe | phonegap | 2.2.0 | cpe:2.3:a:adobe:phonegap:2.2.0:rc2:*:*:*:*:*:* |
| adobe | phonegap | 2.3.0 | cpe:2.3:a:adobe:phonegap:2.3.0:*:*:*:*:*:*:* |
| adobe | phonegap | 2.3.0 | cpe:2.3:a:adobe:phonegap:2.3.0:rc1:*:*:*:*:*:* |
| adobe | phonegap | 2.3.0 | cpe:2.3:a:adobe:phonegap:2.3.0:rc2:*:*:*:*:*:* |
Related
prion
prion
Code injection
2014-03-03 04:50:00
cvelist
cvelist
CVE-2014-1882
2014-03-03 02:00:00
veracode
veracode
Bypassing Device-Resource Restrictions
2017-02-02 04:46:11
ubuntucve
ubuntucve
CVE-2014-1882
2014-03-03 00:00:00
nvd
nvd
CVE-2014-1882
2014-03-03 04:50:46
CVSS2
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
AI Score
6.8
Confidence
Low
EPSS
0.029
Percentile
90.8%
Related for CVE-2014-1882