CVEvulnerability
CVE-2015-1835
5.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2017-10-27
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 5.3 MEDIUM — CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
- CVSS 2.0 ([email protected])
- 2.6 LOW — AV:N/AC:H/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-20
Description
Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in config.xml, allows remote attackers to modify undefined secondary configuration variables (preferences) via a crafted intent: URL.
Affected configurations
• apache cordova (<= 3.7.1)
• apache cordova 4.0.0
• apache cordova 4.0.1
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- http://blog.trendmicro.com/trendlabs-security-intelligence/trend-micro-discovers-apache-vulnerability-that-allows-one-click-modification-of-android-apps/ Exploit, Technical Description, Third Party Advisory
- http://www.securityfocus.com/bid/74866 Third Party Advisory, VDB Entry
- https://cordova.apache.org/announcements/2015/05/26/android-402.html Release Notes, Vendor Advisory
- http://blog.trendmicro.com/trendlabs-security-intelligence/trend-micro-discovers-apache-vulnerability-that-allows-one-click-modification-of-android-apps/ Exploit, Technical Description, Third Party Advisory
- http://www.securityfocus.com/bid/74866 Third Party Advisory, VDB Entry
- https://cordova.apache.org/announcements/2015/05/26/android-402.html Release Notes, Vendor Advisory