CVE-2015-1835

CWE-20 — Improper Input Validation3 documents3 sources
Severity
5.3MEDIUM
EPSS
0.6%
top 29.82%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Apache Cordova
Timeline
PublishedOct 27
Latest updateMay 17

Description

Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in config.xml, allows remote attackers to modify undefined secondary configuration variables (preferences) via a crafted intent: URL.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:NExploitability: 1.6 | Impact: 3.6

Affected Packages1 packages

▶NVDapache/cordova3.7.1+2

🔴Vulnerability Details

2
GHSA
GHSA-2px6-cp37-hh2h: Apache Cordova Android before 3↗2022-05-17
▶
CVEList
CVE-2015-1835: Apache Cordova Android before 3↗2017-10-27
▶
CVE-2015-1835 (MEDIUM CVSS 5.3) | Apache Cordova Android before 3.7.2 | cvebase.io