HIGH🇵🇱 Wersja polska

CVE-2014-0072

CVSS 7.5v3.0pub. 2017-10-30upd. 2026-05-13

ios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin (org.apache.cordova.file-transfer) before 0.4.2 for iOS and the File-Transfer plugin for iOS from Cordova 2.4.0 through 2.9.0 might allow remote attackers to spoof SSL servers by leveraging a default value of true for the trustAllHosts option.

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

  • Apache Cordova

    APP
    Apache
    2.4.0 – 2.9.0

  • Apache Cordova File Transfer

    APP
    Apache
    ≤ 0.4.1
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2014-0073CRITICAL9.8ten sam produkt

The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin (org.apache.cordova.inappbrow...

CVE-2021-21315HIGH7.1⚠ KEVten sam produkt

The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of f...

CVE-2017-3160HIGH7.4ten sam produkt

After the Android platform is added to Cordova the first time, or after a project is created using the build s...

CVE-2016-6799HIGH7.5ten sam produkt

Product: Apache Cordova Android 5.2.2 and earlier. The application calls methods of the Log class. Messages pa...

CVE-2014-1881HIGH7.5ten sam produkt

Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intende...