Skip to main content

Cordova CVE-2015-5207

MEDIUM
7PK - Security Features (CWE-254)
2016-05-09 secalert@redhat.com
Authentication Bypass Apple Apache Cordova
5.3
CVSS 3.0 · NVD
Share

Severity by source

NVD PRIMARY
5.3 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

1
CVE Published
May 09, 2016 - 20:59 cve.org
MEDIUM 5.3

DescriptionCVE.org

Apache Cordova iOS before 4.0.0 might allow attackers to bypass a URL whitelist protection mechanism in an app and load arbitrary resources by leveraging unspecified methods.

AnalysisAI

Apache Cordova iOS before 4.0.0 might allow attackers to bypass a URL whitelist protection mechanism in an app and load arbitrary resources by leveraging unspecified methods. Rated medium severity (CVSS 5.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-254. Apache Cordova iOS before 4.0.0 might allow attackers to bypass a URL whitelist protection mechanism in an app and load arbitrary resources by leveraging unspecified methods. Affected products include: Apache Cordova. Version information: before 4.0.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Cordova

View all
CVE-2014-0073 CRITICAL
9.8 Oct 30

The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin (org.apache.cordova.inappbrowser) befor
CVE-2014-1884 HIGH POC
7.5 Mar 03

Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier on Windows Phone 7 and 8 do not properly restrict

CVE-2014-1881 HIGH POC
7.5 Mar 03

Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-r
CVE-2021-21315 HIGH POC
7.8 Feb 16

The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions t
CVE-2012-6637 HIGH POC
7.5 Mar 03

Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier do not anchor the end of domain-name regular expre
CVE-2015-1835 MEDIUM POC
5.3 Oct 27

Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in config.xml
CVE-2014-1882 HIGH
7.5 Mar 03

Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-r
CVE-2014-0072 HIGH
7.5 Oct 30

ios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin (org.apache.cordova.file-transfer) before 0.
CVE-2016-6799 HIGH
7.5 May 09

Product: Apache Cordova Android 5.2.2 and earlier. Rated high severity (CVSS 7.5), this vulnerability is remotely exploi
CVE-2014-3500 MEDIUM
6.4 Nov 15

Apache Cordova Android before 3.5.1 allows remote attackers to change the start page via a crafted intent URL. Rated med
CVE-2015-8320 MEDIUM
5.0 Nov 23

Apache Cordova-Android before 3.7.0 improperly generates random values for BridgeSecret data, which makes it easier for

CVE-2015-5208 MEDIUM
4.4 May 09

Apache Cordova iOS before 4.0.0 allows remote attackers to execute arbitrary plugins via a link. Rated medium severity (

Same weakness CWE-254 – 7PK - Security Features

View all
CVE-2015-1158 CRITICAL POC
10.0
CVE-2016-2296 CRITICAL POC
9.4
CVE-2016-2118 HIGH POC
7.5
CVE-2015-1793 MEDIUM POC
6.5
CVE-2015-3693 CRITICAL POC
9.3
CVE-2016-0128 MEDIUM
6.8
CVE-2016-10178 CRITICAL POC
9.8
CVE-2015-8286 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2015-5207 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy