Lucene search

ApacheCVE-2017-3160

HistoryFeb 01, 2018 - 9:29 p.m.

CVE-2017-3160

2018-02-0121:29:00

apache

web.nvd.nist.gov

android

cordova

platform

vulnerability

mitm

attack

gradle

fetch

security

nvd

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS3

7.4

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

7.2

Confidence

High

EPSS

0.001

Percentile

33.2%

JSON

After the Android platform is added to Cordova the first time, or after a project is created using the build scripts, the scripts will fetch Gradle on the first build. However, since the default URI is not using https, it is vulnerable to a MiTM and the Gradle executable is not safe. The severity of this issue is high due to the fact that the build scripts immediately start a build after Gradle has been fetched. Developers who are concerned about this issue should install version 6.1.2 or higher of Cordova-Android. If developers are unable to install the latest version, this vulnerability can easily be mitigated by setting the CORDOVA_ANDROID_GRADLE_DISTRIBUTION_URL environment variable to https://services.gradle.org/distributions/gradle-2.14.1-all.zip

Affected configurations

Nvd

Vulners

Node

apachecordovaRange<6.1.2android

VendorProductVersionCPE
apachecordova*cpe:2.3:a:apache:cordova:*:*:*:*:*:android:*:*

Vendor	Product	Version	CPE
apache	cordova	*	cpe:2.3:a:apache:cordova::::::android::*

CNA Affected

[
  {
    "product": "Apache Cordova Android",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "status": "affected",
        "version": "Apache Cordova 6.1.0 and below"
      }
    ]
  }
]

References

www.securityfocus.com/bid/95838

cordova.apache.org/announcements/2017/01/27/android-612.html

www.oracle.com/security-alerts/cpuapr2020.html

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS3

7.4

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

7.2

Confidence

High

EPSS

0.001

Percentile

33.2%

JSON

Related for CVE-2017-3160