Description
The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin (org.apache.cordova.inappbrowser) before 0.3.2 for iOS and the In-App-Browser plugin for iOS from Cordova 2.6.0 through 2.9.0 does not properly validate callback identifiers, which allows remote attackers to execute arbitrary JavaScript in the host page and consequently gain privileges via a crafted gap-iab: URI.
Remediation
References
https://github.com/apache/cordova-plugin-inappbrowser/commit/26702cb0720c5c394b407c23570136c53171fa55
https://exchange.xforce.ibmcloud.com/vulnerabilities/91560
http://www.securityfocus.com/bid/65959
http://seclists.org/fulldisclosure/2014/Mar/30
http://d3adend.org/blog/?p=403
http://www.securityfocus.com/archive/1/531334/100/0/threaded
https://mail-archives.apache.org/mod_mbox/cordova-dev/201403.mbox/%3CCAK_TSXLGJag5Q9ATUCbFtkWvMWX9XnC80kKp-HKi25gPcvV4gw%40mail.gmail.com%3E
Related Vulnerabilities
CVE-2022-26969 Vulnerability in npm package directus
CVE-2021-23337 Vulnerability in npm package lodash.template
CVE-2019-10201 Vulnerability in maven package org.keycloak:keycloak-services
CVE-2023-46653 Vulnerability in maven package org.jenkins-ci.plugins:lambdatest-automation
CVE-2023-46998 Vulnerability in maven package org.webjars.bower:bootbox