Evil-DB LogoEvil-DB
← All CVEs

CVE-2014-1881

high · 7.5

Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-resource restrictions of an event-based bridge via a crafted library clone that leverages IFRAME script execution and waits a certain amount of time for an OnJsPrompt handler return value as an alternative to correct synchronization.

7.5
CVSS
11.2%
EPSS (exploit prob.)
96th
EPSS percentile
2014-03-03
Published

AV:N/AC:L/Au:N/C:P/I:P/A:P

Weaknesses

CWE-264

Affected products

VendorProductAffected versions
apachecordova<= 3.3.0
apachecordova3.0.0
apachecordova3.0.0
apachecordova3.1.0
apachecordova3.1.0
apachecordova3.2.0
apachecordova3.2.0
apachecordova3.3.0
adobephonegap<= 2.9.0
adobephonegap2.0.0
adobephonegap2.0.0
adobephonegap2.1.0
adobephonegap2.2.0
adobephonegap2.2.0
adobephonegap2.2.0
adobephonegap2.3.0
adobephonegap2.3.0
adobephonegap2.3.0
adobephonegap2.4.0
adobephonegap2.4.0
adobephonegap2.5.0
adobephonegap2.5.0
adobephonegap2.6.0
adobephonegap2.6.0
adobephonegap2.7.0
adobephonegap2.7.0
adobephonegap2.8.0
adobephonegap2.8.1
adobephonegap2.9.0

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2014-1881