Security Advisory

CVE-2014-0073

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2017-10-30 19:00:00

Last updated 2024-08-06 09:05:37

Assigner redhat

CVSS score not scored

State PUBLISHED

Description

The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin (org.apache.cordova.inappbrowser) before 0.3.2 for iOS and the In-App-Browser plugin for iOS from Cordova 2.6.0 through 2.9.0 does not properly validate callback identifiers, which allows remote attackers to execute arbitrary JavaScript in the host page and consequently gain privileges via a crafted gap-iab: URI.

← Browse all CVEs View on cve.org ↗