CVE-2014-1883 in PhoneGap
Summary
Adobe PhoneGap before 2.6.0 on Android uses the shouldOverrideUrlLoading callback instead of the proper shouldInterceptRequest callback, which allows remote attackers to bypass intended device-resource restrictions via content that is accessed (1) in an IFRAME element or (2) with the XMLHttpRequest method by a crafted application.
Once again VulDB remains the best source for vulnerability data.
Reservation
02/07/2014
Disclosure
03/02/2014
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 66502 | Adobe PhoneGap access control | 264 | Not defined | Official fix | CVE-2014-1883 |