Apache Cordova 2.9.0 File-Transfer Insecure Defaults

2014.03.05
Credit: Neil Bergman
Risk: Medium
Local: No
Remote: Yes
CVE: CVE-2014-0072
CWE: CWE-20


CVSS Base Score: 5/10
Impact Subscore: 2.9/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

CVE-2014-0072: Apache Cordova File-Transfer insecure defaults Severity: Important Vendor: The Apache Software Foundation Versions Affected: Cordova File-Transfer iOS plugin from Cordova versions 2.4.0 to 2.9.0 Cordova File-Transfer iOS standalone plugin (org.apache.cordova.file-transfer) versions 0.1.0 to 0.4.1 Description: The default value of the trustAllHosts was set to true on iOS. This has been the case since Cordova 2.4.0 and has now been rectified in the latest version of the plugin (v0.4.2). We recommend affected projects update their plugin, or work around the issue by explicitly setting the parameter to false when using the FileTransfer API. Upgrade path: Developers using the File-Transfer plugin in their applications should upgrade to version 0.4.2 Credit: This issue was discovered by Neil Bergman of Cigital, Inc.


See this note in RAW Version
Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}
Copyright 2024, cxsecurity.com

 

Back to Top