CVE-2015-1835
MEDIUM 5.3EPSS 5.9%
Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in config.xml, allows remote attackers to modify undefined secondary configuration variables (preferences) via a crafted intent: URL.
- CVSS v3.0 NVD
- 5.3 MEDIUM
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N - CVSS v2.0 NVD
- 2.6 LOW
AV:N/AC:H/Au:N/C:N/I:P/A:N - EPSS
- 5.91% chance of exploitation in the next 30 days, 93rd percentile
- Published
- 2017-10-27
- Updated
- 2024-08-06
Proof-of-concept exploits (1)
Security advisories
- https://cordova.apache.org/announcements/2015/05/26/android-402.html
- http://blog.trendmicro.com/trendlabs-security-intelligence/trend-micro-discovers-apache-v…
- http://www.securityfocus.com/bid/74866