CVE-2015-1835

Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in config.xml, allows remote attackers to modify undefined secondary configuration variables (preferences) via a crafted intent: URL.

CVSS v3.0

5.3 MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

CVSS v2.0

2.6 LOWAV:N/AC:H/Au:N/C:N/I:P/A:N

EPSS

5.91% chance of exploitation in the next 30 days, 93th percentile

Published

2017-10-27

Updated

2024-08-06

Proof-of-concept exploits (1)

• http://blog.trendmicro.com/trendlabs-security-intelligence/trend-micro-discovers-apache-v…

References

• CVE Record
• NVD entry

Related

• CVE-2015-1833
• CVE-2015-1855
• CVE-2015-1830
• CVE-2015-1862
• CVE-2015-1815
• CVE-2015-1875