Unscored severity · published Nov 15, 2014
CVE-2014-3501
Apache Cordova Android before 3.5.1 allows remote attackers to bypass the HTTP whitelist and connect to arbitrary servers by using JavaScript to open WebSocket connections through…
–
CVSS
3.7%
EPSS
No
On KEV
Description
Apache Cordova Android before 3.5.1 allows remote attackers to bypass the HTTP whitelist and connect to arbitrary servers by using JavaScript to open WebSocket connections through WebView.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.7% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Cordova · Apache
3.5.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3501
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3501
Vendor Advisory
http://cordova.apache.org/announcements/2014/08/04/android-351.html
www.securityfocus.com
http://www.securityfocus.com/bid/69041
More from Cordova
7.8
CVE-2021-21315
Command Injection Vulnerability
9.8
CVE-2014-0073
The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin (org.apache.cordova.inappbrowser) before 0.3.2 for iOS and the In-App-Browser plugin for iOS from…
7.5
CVE-2014-0072
ios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin (org.apache.cordova.file-transfer) before 0.4.2 for iOS and the File-Transfer plugin for iOS from…
7.5
CVE-2016-6799
Product: Apache Cordova Android 5.2.2 and earlier
7.4
CVE-2017-3160
After the Android platform is added to Cordova the first time, or after a project is created using the build scripts, the scripts will fetch Gradle on the first build