Remote Code Execution Vulnerability in Apache Cordova and Adobe PhoneGap

CVE-2014-1882

Summary

Apache Cordova versions 3.3.0 and earlier, along with Adobe PhoneGap versions 2.9.0 and earlier, contain a vulnerability that allows remote attackers to bypass security measures intended to restrict access to device resources. This occurs through a crafted library clone that exploits IFRAME script execution, enabling direct access to bridge JavaScript objects. Exploitation of this weakness could permit unauthorized manipulation of the underlying device functionalities through specific calls, potentially leading to severe consequences for user data and device integrity.

References