CVE-2015-5207

Published: May 9, 2016Modified: May 6, 2026

5.3

Vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Exploitability: 1.8 / Impact: 3.4

Source: NVD

Description

Apache Cordova iOS before 4.0.0 might allow attackers to bypass a URL whitelist protection mechanism in an app and load arbitrary resources by leveraging unspecified methods.

Affected (1)

Products: Apache: Cordova

Apache

1 product

Cordova

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Cordova	Up to 3.9.1

Related CWEs

CWE-254

CWE-284

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (12)

http://jvn.jp/en/jp/JVN35341085/index.html

Source: secalert@redhat.com

http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000058.html

Source: secalert@redhat.com

http://packetstormsecurity.com/files/136840/Apache-Cordova-iOS-3.9.1-Access-Bypass.html

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/538211/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/bid/88764

Source: secalert@redhat.com

https://cordova.apache.org/announcements/2016/04/27/security.html

Source: secalert@redhat.com

Vendor Advisory

http://jvn.jp/en/jp/JVN35341085/index.html