[CVE-2014-0073] Apache Cordova In-App-Browser privilege escalation

Ian Clelland <[email protected]>
Newsgroups gmane.comp.security.full-disclosure,gmane.comp.apache.incubator.bigtop.devel
Message-ID <CAK_TSXLGJag5Q9ATUCbFtkWvMWX9XnC80kKp-HKi25gPcvV4gw@mail.gmail.com> 
CVE-2014-0073: Apache Cordova In-App-Browser privilege escalation
Severity: Important
Vendor:The Apache Software Foundation
Versions Affected:Cordova In-App-Browser iOS plugin from Cordova versions
2.6.0 to 2.9.0Cordova In-App-Browser iOS standalone plugin
(org.apache.cordova.inappbrowser) versions 0.1.0 to 0.3.1
Description:An exploit was found in the InAppBrowser plugin that would
allow amalicious site to execute arbitrary JavaScript in the host page.
Theproblem has been fixed in the latest version of the plugin (v0.3.2).
Werecommend affected projects update their plugin.
Upgrade path:Developers using the In-App Browser plugin in their
applications shouldupgrade to version 0.3.2
Credit:This issue was discovered by Neil Bergman of Cigital, Inc.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.