Description

Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in config.xml, allows remote attackers to modify undefined secondary configuration variables (preferences) via a crafted intent: URL.

Remediation

References

http://blog.trendmicro.com/trendlabs-security-intelligence/trend-micro-discovers-apache-vulnerability-that-allows-one-click-modification-of-android-apps/

http://www.securityfocus.com/bid/74866

https://cordova.apache.org/announcements/2015/05/26/android-402.html

Related Vulnerabilities

CVE-2022-41253 Vulnerability in maven package org.jenkins-ci.plugins:cons3rt

CVE-2022-36033 Vulnerability in maven package org.jsoup:jsoup

CVE-2020-5263 Vulnerability in maven package org.webjars.npm:auth0-js

CVE-2023-24789 Vulnerability in maven package org.jeecgframework.boot:jeecg-boot-parent

CVE-2022-25900 Vulnerability in npm package git-clone

Severity

Medium

Classification

CWE-20 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Tags

Exploit Technical Description Third Party Advisory VDB Entry Release Notes Vendor Advisory