Information Leak in Apache Cordova Android Versions

CVE-2016-6799

Summary

Apache Cordova Android versions prior to 5.2.2 contain a vulnerability that exposes sensitive information through log methods. The application utilizes Log class methods (Log.v(), Log.d(), Log.i(), Log.w(), and Log.e()), which store messages in circular buffers on the device. By default, the logs retain up to four 16 KB rotated buffers alongside the current log. On devices running Android versions prior to 4.1 (Jelly Bean), logged data lacks application isolation, permitting any installed application to access log information from others. This can lead to potential information leakage, where sensitive data logged by one application may be readable by another, posing a significant risk to user privacy and application security.

References