Description

Apache Cordova Android before 3.5.1 allows remote attackers to bypass the HTTP whitelist and connect to arbitrary servers by using JavaScript to open WebSocket connections through WebView.

Remediation

References

http://cordova.apache.org/announcements/2014/08/04/android-351.html

http://www.securityfocus.com/bid/69041

Related Vulnerabilities

CVE-2020-13883 Vulnerability in maven package org.wso2.carbon.governance:org.wso2.carbon.governance.lcm

CVE-2023-50728 Vulnerability in npm package octokit

CVE-2023-30514 Vulnerability in maven package org.jenkins-ci.plugins:azure-keyvault

CVE-2021-41183 Vulnerability in maven package org.webjars.bower:jquery-ui

CVE-2022-42467 Vulnerability in maven package org.apache.isis.core:isis-core-config

Severity

Critical

Classification

CWE-254

Tags

Vendor Advisory