CVE-2014-1883: High severity Adobe PhoneGap vulnerability
Adobe PhoneGap before 2.6.0 on Android uses the shouldOverrideUrlLoading callback instead of the proper shouldInterceptRequest callback, which allows remote attackers to bypass intended device-resource restrictions via content that is accessed (1) in an IFRAME element or (2) with the XMLHttpRequest method by a crafted application.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Adobe PhoneGap (Android)to a version that resolves this vulnerability.Fixed in 2.6.0
Event History
Frequently Asked Questions
What is the severity of CVE-2014-1883?
CVE-2014-1883 is classified as a medium severity vulnerability.
How do I fix CVE-2014-1883?
To mitigate CVE-2014-1883, upgrade Adobe PhoneGap to version 2.6.0 or later.
What systems are affected by CVE-2014-1883?
CVE-2014-1883 affects Adobe PhoneGap versions prior to 2.6.0 on Android.
What does CVE-2014-1883 allow attackers to do?
CVE-2014-1883 allows remote attackers to bypass device-resource restrictions via specific content accessed through an IFRAME or XMLHttpRequest.
What callback method is improperly used in CVE-2014-1883?
CVE-2014-1883 improperly uses the shouldOverrideUrlLoading callback instead of the shouldInterceptRequest callback.