CVE-2019-0219

Published: Jan 14, 2020Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a specially crafted gap-iab: URI.

Affected (8)

Products: Apache: Cordova Inappbrowser · Oracle: Instantis Enterprisetrack, Retail Xstore Point Of Service

1 product

Cordova Inappbrowser

2 products

Instantis Enterprisetrack

Retail Xstore Point Of Service

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Cordova Inappbrowser	Up to 3.0.0

Configuration B

7 vulnerable

Vulnerable Software	Affected Versions
Oracle Instantis Enterprisetrack	Version 17.1
Oracle Instantis Enterprisetrack	Version 17.2
Oracle Instantis Enterprisetrack	Version 17.3
Oracle Retail Xstore Point Of Service	Version 16.0.6
Oracle Retail Xstore Point Of Service	Version 17.0.4
Oracle Retail Xstore Point Of Service	Version 18.0.3
Oracle Retail Xstore Point Of Service	Version 19.0.2

References (12)

http://www.openwall.com/lists/oss-security/2019/11/28/1

Source: security@apache.org

Mailing ListThird Party Advisory

https://lists.apache.org/thread.html/197482d5ab80c0bff4a5ec16e1b0466df38389d9a4b5331d777f14fc%40%3Cdev.cordova.apache.org%3E

Source: security@apache.org

Mailing ListVendor Advisory

https://lists.apache.org/thread/4vtg0trdrh5203dktt4f3vkd5z2d5ndj

Source: security@apache.org

Mailing ListVendor Advisory

https://www.oracle.com//security-alerts/cpujul2021.html

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuApr2021.html

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujul2022.html

Source: security@apache.org

http://www.openwall.com/lists/oss-security/2019/11/28/1

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://lists.apache.org/thread.html/197482d5ab80c0bff4a5ec16e1b0466df38389d9a4b5331d777f14fc%40%3Cdev.cordova.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListVendor Advisory

https://lists.apache.org/thread/4vtg0trdrh5203dktt4f3vkd5z2d5ndj

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListVendor Advisory

https://www.oracle.com//security-alerts/cpujul2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuApr2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujul2022.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.