Cordova CVE-2015-5208

MEDIUM

Improper Input Validation (CWE-20)

2016-05-09 secalert@redhat.com

Apple Information Disclosure Apache Cordova

4.4

CVSS 3.0 · NVD

Share

Severity by source

NVD PRIMARY

4.4 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

1

CVE Published

May 09, 2016 - 20:59 cve.org

MEDIUM 4.4

DescriptionCVE.org

Apache Cordova iOS before 4.0.0 allows remote attackers to execute arbitrary plugins via a link.

AnalysisAI

Apache Cordova iOS before 4.0.0 allows remote attackers to execute arbitrary plugins via a link. Rated medium severity (CVSS 4.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-20. Apache Cordova iOS before 4.0.0 allows remote attackers to execute arbitrary plugins via a link. Affected products include: Apache Cordova. Version information: before 4.0.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Cordova

View all

CVE-2014-0073 CRITICAL Act Now

The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin (org.apache.cordova.inappbrowser) befor

CVE-2014-1884 HIGH This Week POC

Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier on Windows Phone 7 and 8 do not properly restrict

CVE-2014-1881 HIGH This Week POC

Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-r

CVE-2021-21315 HIGH This Week POC

The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions t

CVE-2012-6637 HIGH This Week POC

Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier do not anchor the end of domain-name regular expre

CVE-2015-1835 MEDIUM This Month POC

Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in config.xml

CVE-2014-1882 HIGH This Week

Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-r

CVE-2014-0072 HIGH This Week

ios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin (org.apache.cordova.file-transfer) before 0.

CVE-2016-6799 HIGH This Week

Product: Apache Cordova Android 5.2.2 and earlier. Rated high severity (CVSS 7.5), this vulnerability is remotely exploi

CVE-2014-3500 MEDIUM This Month

Apache Cordova Android before 3.5.1 allows remote attackers to change the start page via a crafted intent URL. Rated med

CVE-2015-8320 MEDIUM This Month

Apache Cordova-Android before 3.7.0 improperly generates random values for BridgeSecret data, which makes it easier for

CVE-2015-5207 MEDIUM This Month

Apache Cordova iOS before 4.0.0 might allow attackers to bypass a URL whitelist protection mechanism in an app and load

Same weakness CWE-20 – Improper Input Validation

View all

CVE-2021-44228 CRITICAL POC

CVE-2024-3400 CRITICAL POC

CVE-2022-47966 CRITICAL POC

CVE-2023-22515 CRITICAL POC

CVE-2009-0927 HIGH POC

CVE-2017-9791 CRITICAL POC

CVE-2017-15944 CRITICAL POC

CVE-2019-0604 CRITICAL POC

Same technique Information Disclosure

View all

CVE-2013-2251 CRITICAL POC

CVE-2017-5638 CRITICAL POC

CVE-2025-24813 CRITICAL POC

CVE-2015-1701 HIGH POC

CVE-2017-0147 HIGH POC

CVE-2014-6324 HIGH POC

CVE-2023-7028 CRITICAL POC

CVE-2017-0213 HIGH POC

Share

CVE-2015-5208 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy