Description
Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in config.xml, allows remote attackers to modify undefined secondary configuration variables (preferences) via a crafted intent: URL.
Remediation
References
http://blog.trendmicro.com/trendlabs-security-intelligence/trend-micro-discovers-apache-vulnerability-that-allows-one-click-modification-of-android-apps/
http://www.securityfocus.com/bid/74866
https://cordova.apache.org/announcements/2015/05/26/android-402.html
Related Vulnerabilities
CVE-2017-1000043 Vulnerability in maven package org.webjars.npm:mapbox.js
CVE-2022-31160 Vulnerability in maven package org.webjars.bowergithub.jquery:jquery-ui
CVE-2023-32315 Vulnerability in maven package org.igniterealtime.openfire:xmppserver
CVE-2020-14195 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind