Description

Apache Cordova Android before 3.5.1 allows remote attackers to bypass the HTTP whitelist and connect to arbitrary servers by using JavaScript to open WebSocket connections through WebView.

Remediation

References

http://cordova.apache.org/announcements/2014/08/04/android-351.html

http://www.securityfocus.com/bid/69041

Related Vulnerabilities

CVE-2020-4070 Vulnerability in maven package org.w3c.css:css-validator

CVE-2023-48293 Vulnerability in maven package org.xwiki.contrib:xwiki-application-admintools

CVE-2022-43406 Vulnerability in maven package org.jenkins-ci.plugins.workflow:workflow-cps-global-lib

CVE-2019-17638 Vulnerability in maven package org.eclipse.jetty:jetty-server

CVE-2021-21608 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

Severity

Critical

Tags

Vendor Advisory CWE-254