CVE-2014-3501: Medium severity apache cordova vulnerability
Published Nov 15, 2014
·Updated
Apache Cordova Android before 3.5.1 allows remote attackers to bypass the HTTP whitelist and connect to arbitrary servers by using JavaScript to open WebSocket connections through WebView.
Affected Software
1 affected component
Apache Cordova Android=3.5.0
Event History
Nov 15, 2014
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-3501?
CVE-2014-3501 is classified as a medium severity vulnerability due to its potential to allow unauthorized access to arbitrary servers.
2
How do I fix CVE-2014-3501?
To mitigate CVE-2014-3501, upgrade Apache Cordova Android to version 3.5.1 or later.
3
What software versions are affected by CVE-2014-3501?
CVE-2014-3501 affects Apache Cordova Android version 3.5.0 and earlier.
4
What type of attack does CVE-2014-3501 enable?
CVE-2014-3501 enables remote attackers to bypass the HTTP whitelist through WebSocket connections.
5
Is CVE-2014-3501 applicable to iOS versions of Cordova?
No, CVE-2014-3501 specifically affects the Android version of Apache Cordova.