CVSS: 7.5EPSS: 2%CPEs: 29EXPL: 0CVE-2014-1882
https://notcve.org/view.php?id=CVE-2014-1882
Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-resource restrictions of an event-based bridge via a crafted library clone that leverages IFRAME script execution and directly accesses bridge JavaScript objects, as demonstrated by certain cordova.require calls. Apache Cordova 3.3.0 y anteriores y Adobe PhoneGap 2.9.0 y anteriores permiten a atacantes remotos evadir restricciones "device-resource" de un puente basado en eventos a través de un clon de librería manipulada que aprovecha la ejecución de script IFRAME y acceda directamente objetos JavaScript puente, tal y como se demostró con ciertas llamadas cordova.require. • http://openwall.com/lists/oss-security/2014/02/07/9 http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt http://seclists.org/bugtraq/2014/Jan/96 http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf http://www.internetsociety.org/ndss2014/programme#session3 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 1%CPEs: 33EXPL: 1CVE-2014-1884
https://notcve.org/view.php?id=CVE-2014-1884
Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier on Windows Phone 7 and 8 do not properly restrict navigation events, which allows remote attackers to bypass intended device-resource restrictions via content that is accessed (1) in an IFRAME element or (2) with the XMLHttpRequest method by a crafted application. Apache Cordova 3.3.0 y anteriores y Adobe PhoneGap 2.9.0 y anteriores en Windows Phone 7 y 8 no restringen debidamente eventos de navegación, lo que permite a atacantes remotos evadir restricciones "device-resource" a través de contenido que es accedido (1) en un elemento IFRAME o (2) con el método XMLHttpRequest mediante una aplicación manipulada. • http://openwall.com/lists/oss-security/2014/02/07/9 http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt http://seclists.org/bugtraq/2014/Jan/96 http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf http://www.internetsociety.org/ndss2014/programme#session3 • CWE-264: Permissions, Privileges, and Access Controls •