====================================================================== CVE-2015-5256: Apache Cordova vulnerable to improper application of whitelist restrictions Severity: Medium Vendor: The Apache Software Foundation Versions Affected: Cordova Android 3.7.2 and earlier Description: Android applications created using Apache Cordova that use a remote server contain a vulnerability where whitelist restrictions are not properly applied. Improperly crafted URIs could be used to circumvent the whitelist, allowing for the execution of non-whitelisted Javascript. Upgrade path: Developers who are concerned about this should rebuild their applications with Cordova Android 4.1.1 or later and use the new whitelist. Developers using remote content roots should also use SSL, as well as Content Security Policy to further mitigate this issue. Credit: Muneaki Nishimura of Sony Digital Network Applications, Inc