CVE-2014-0073

Critical

Published: 30/10/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin before version 0.3.2 for iOS and the In-App-Browser plugin for iOS from Cordova 2.6.0 through 2.9.0 does not properly validate callback identifiers, allowing remote attackers to execute arbitrary JavaScript in the host page.

Risk Assessment

Attackers may gain unauthorized privileges, potentially leading to serious security breaches of the application and user data.

Recommendation

It is recommended to update the plugin to the latest version to ensure proper validation of callback identifiers and minimize the risk of attacks.

Original NVD description (English source)

The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin (org.apache.cordova.inappbrowser) before 0.3.2 for iOS and the In-App-Browser plugin for iOS from Cordova 2.6.0 through 2.9.0 does not properly validate callback identifiers, which allows remote attackers to execute arbitrary JavaScript in the host page and consequently gain privileges via a crafted gap-iab: URI.