Description
The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin (org.apache.cordova.inappbrowser) before 0.3.2 for iOS and the In-App-Browser plugin for iOS from Cordova 2.6.0 through 2.9.0 does not properly validate callback identifiers, which allows remote attackers to execute arbitrary JavaScript in the host page and consequently gain privileges via a crafted gap-iab: URI.
Remediation
References
https://github.com/apache/cordova-plugin-inappbrowser/commit/26702cb0720c5c394b407c23570136c53171fa55
https://exchange.xforce.ibmcloud.com/vulnerabilities/91560
http://www.securityfocus.com/bid/65959
http://seclists.org/fulldisclosure/2014/Mar/30
http://d3adend.org/blog/?p=403
http://www.securityfocus.com/archive/1/531334/100/0/threaded
https://mail-archives.apache.org/mod_mbox/cordova-dev/201403.mbox/%3CCAK_TSXLGJag5Q9ATUCbFtkWvMWX9XnC80kKp-HKi25gPcvV4gw%40mail.gmail.com%3E
Related Vulnerabilities
CVE-2021-23490 Vulnerability in npm package parse-link-header
CVE-2022-4350 Vulnerability in maven package net.mingsoft:ms-mcms
CVE-2023-29522 Vulnerability in maven package org.xwiki.platform:xwiki-platform-web-templates
CVE-2023-26104 Vulnerability in npm package lite-web-server
CVE-2023-51079 Vulnerability in maven package org.mvel:mvel2