Evil-DB LogoEvil-DB
← All CVEs

CVE-2014-1882

high · 7.5

Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-resource restrictions of an event-based bridge via a crafted library clone that leverages IFRAME script execution and directly accesses bridge JavaScript objects, as demonstrated by certain cordova.require calls.

7.5
CVSS
11.7%
EPSS (exploit prob.)
96th
EPSS percentile
2014-03-03
Published

AV:N/AC:L/Au:N/C:P/I:P/A:P

Weaknesses

CWE-264

Affected products

VendorProductAffected versions
adobephonegap<= 2.9.0
adobephonegap2.0.0
adobephonegap2.0.0
adobephonegap2.1.0
adobephonegap2.2.0
adobephonegap2.2.0
adobephonegap2.2.0
adobephonegap2.3.0
adobephonegap2.3.0
adobephonegap2.3.0
adobephonegap2.4.0
adobephonegap2.4.0
adobephonegap2.5.0
adobephonegap2.5.0
adobephonegap2.6.0
adobephonegap2.6.0
adobephonegap2.7.0
adobephonegap2.7.0
adobephonegap2.8.0
adobephonegap2.8.1
adobephonegap2.9.0
apachecordova<= 3.3.0
apachecordova3.0.0
apachecordova3.0.0
apachecordova3.1.0
apachecordova3.1.0
apachecordova3.2.0
apachecordova3.2.0
apachecordova3.3.0

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2014-1882