Description

Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in config.xml, allows remote attackers to modify undefined secondary configuration variables (preferences) via a crafted intent: URL.

Remediation

References

http://blog.trendmicro.com/trendlabs-security-intelligence/trend-micro-discovers-apache-vulnerability-that-allows-one-click-modification-of-android-apps/

http://www.securityfocus.com/bid/74866

https://cordova.apache.org/announcements/2015/05/26/android-402.html

Related Vulnerabilities

CVE-2022-43183 Vulnerability in maven package com.xuxueli:xxl-job

CVE-2020-13955 Vulnerability in maven package org.apache.calcite:calcite-core

CVE-2023-4853 Vulnerability in maven package io.quarkus:quarkus-csrf-reactive

CVE-2018-15685 Vulnerability in npm package electron

CVE-2023-47322 Vulnerability in maven package org.silverpeas.core:silverpeas-core-web

Severity

Medium

Classification

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Tags

Exploit Technical Description Third Party Advisory VDB Entry Release Notes Vendor Advisory CWE-20