High severity · published Oct 30, 2017
CVE-2014-0072
ios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin (org.apache.cordova.file-transfer) before 0.4.2 for iOS and the File-Transfer plugin for iOS from…
7.5
CVSS
7.7%
EPSS
No
On KEV
Description
ios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin (org.apache.cordova.file-transfer) before 0.4.2 for iOS and the File-Transfer plugin for iOS from Cordova 2.4.0 through 2.9.0 might allow remote attackers to spoof SSL servers by leveraging a default value of true for the trustAllHosts option.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)7.7% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Cordova · Apache
2.4.0 through 2.9.0 · source: NVD
CF
Cordova File Transfer · Apache
through 0.4.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-0072
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-0072
Issue Tracking
http://d3adend.org/blog/?p=403
Mailing List
http://seclists.org/fulldisclosure/2014/Mar/29
www.securityfocus.com
http://www.securityfocus.com/archive/1/531335/100/0/threaded
Issue Tracking
https://exchange.xforce.ibmcloud.com/vulnerabilities/91561
Issue Tracking
https://github.com/apache/cordova-plugin-file-transfer/commit/a1d6fc07e8a40c1b2b16f4103c403b30e1089668
mail-archives.apache.org
https://mail-archives.apache.org/mod_mbox/cordova-dev/201403.mbox/%3CCAK_TSXKL9JtkehHC0jEoRwdvVKXt-d5uj40EwNY-Gk3ttX=wJw%40mail.gmail.com%3E
More from Cordova
7.8
CVE-2021-21315
Command Injection Vulnerability
9.8
CVE-2014-0073
The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin (org.apache.cordova.inappbrowser) before 0.3.2 for iOS and the In-App-Browser plugin for iOS from…
7.5
CVE-2016-6799
Product: Apache Cordova Android 5.2.2 and earlier
7.4
CVE-2017-3160
After the Android platform is added to Cordova the first time, or after a project is created using the build scripts, the scripts will fetch Gradle on the first build
5.3
CVE-2015-1835
Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in config.xml, allows remote attackers to modify undefined secondary…