CVE-2020-11990

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

We have resolved a security issue in the camera plugin that could have affected certain Cordova (Android) applications. An attacker who could install (or lead the victim to install) a specially crafted (or malicious) Android application would be able to access pictures taken with the app externally.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	Apache Cordova ( cordova-plugin-camera )	cordova-plugin-camera@4.1.0 and below

References

http://jvn.jp/en/jp/JVN59779918/index.htmlThird Party Advisory
https://cordova.apache.org/news/2020/09/18/camera-plugin-release.htmlRelease Notes, Vendor Advisory
http://jvn.jp/en/jp/JVN59779918/index.htmlThird Party Advisory
https://cordova.apache.org/news/2020/09/18/camera-plugin-release.htmlRelease Notes, Vendor Advisory

Timeline

Published: Dec 1, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-119917.5When using the StreamGenerator, the code parse a user-provided XML. A specially crafted XML, including external system entities, could be us CVE-2020-119937.5Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, loggin CVE-2020-119947.5Server-Side Template Injection and arbitrary file disclosure on Camel templating components CVE-2020-119959.8A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo us CVE-2020-119967.5A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could t CVE-2020-119974.3Apache Guacamole 1.2.0 and earlier do not consistently restrict access to connection history based on user visibility. If multiple users sha CVE-2020-119989.8A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of CVE-2020-119998.1FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, Cont CVE-2020-12008.6<p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application CVE-2020-120007.5The affected product is vulnerable to the handling of serialized data. The issue results from the lack of proper validation of user-supplied CVE-2020-120019.8FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, Cont CVE-2020-120029.8Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple stack-based buffer overflow vulnerabilities exist caused by a lac