CVE-2014-0073

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin (org.apache.cordova.inappbrowser) before 0.3.2 for iOS and the In-App-Browser plugin for iOS from Cordova 2.6.0 through 2.9.0 does not properly validate callback identifiers, which allows remote attackers to execute arbitrary JavaScript in the host page and consequently gain privileges via a crafted gap-iab: URI.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://d3adend.org/blog/?p=403Issue Tracking, Third Party Advisory
http://seclists.org/fulldisclosure/2014/Mar/30Mailing List, Third Party Advisory
http://www.securityfocus.com/archive/1/531334/100/0/threaded
http://www.securityfocus.com/bid/65959Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/91560Issue Tracking, Third Party Advisory, VDB Entry
https://github.com/apache/cordova-plugin-inappbrowser/commit/26702cb0720c5c394b407c23570136c53171fa55Issue Tracking, Patch, Vendor Advisory
https://mail-archives.apache.org/mod_mbox/cordova-dev/201403.mbox/%3CCAK_TSXLGJag5Q9ATUCbFtkWvMWX9XnC80kKp-HKi25gPcvV4gw%40mail.gmail.com%3E
http://d3adend.org/blog/?p=403Issue Tracking, Third Party Advisory
http://seclists.org/fulldisclosure/2014/Mar/30Mailing List, Third Party Advisory
http://www.securityfocus.com/archive/1/531334/100/0/threaded
http://www.securityfocus.com/bid/65959Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/91560Issue Tracking, Third Party Advisory, VDB Entry
https://github.com/apache/cordova-plugin-inappbrowser/commit/26702cb0720c5c394b407c23570136c53171fa55Issue Tracking, Patch, Vendor Advisory
https://mail-archives.apache.org/mod_mbox/cordova-dev/201403.mbox/%3CCAK_TSXLGJag5Q9ATUCbFtkWvMWX9XnC80kKp-HKi25gPcvV4gw%40mail.gmail.com%3E

Timeline

Published: Oct 30, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-00747.5Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication CVE-2014-00755.0Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6 CVE-2014-00761.9The Montgomery ladder implementation in OpenSSL through 1.0.0l does not ensure that certain swap operations have a constant-time behavior, w CVE-2014-00775.5drivers/vhost/net.c in the Linux kernel before 3.13.10, when mergeable buffers are disabled, does not properly validate packet lengths, whic CVE-2014-00784.0The CatalogController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated users to delete arbitrary ca CVE-2014-00795.0The ValidateUserLogon function in provider/libserver/ECSession.cpp in Zarafa 7.1.8, 6.20.0, and earlier, when using certain build conditions CVE-2014-00806.8SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/cast.rb in Active Record in Ruby on Rails 4.0.x CVE-2014-00814.3Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4 CVE-2014-00825.0actionpack/lib/action_view/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during u CVE-2014-00835.5The Ruby net-ldap gem before 0.11 uses a weak salt when generating SSHA passwords.CVE-2014-00845.5Ruby gem openshift-origin-node before 2014-02-14 does not contain a cronjob timeout which could result in a denial of service in cron.daily CVE-2014-00852.1JBoss Fuse did not enable encrypted passwords by default in its usage of Apache Zookeeper. This permitted sensitive information disclosure v