CVE-2017-3160: High severity apache cordova vulnerability
After the Android platform is added to Cordova the first time, or after a project is created using the build scripts, the scripts will fetch Gradle on the first build. However, since the default URI is not using https, it is vulnerable to a MiTM and the Gradle executable is not safe. The severity of this issue is high due to the fact that the build scripts immediately start a build after Gradle has been fetched. Developers who are concerned about this issue should install version 6.1.2 or higher of Cordova-Android. If developers are unable to install the latest version, this vulnerability can easily be mitigated by setting the CORDOVAANDROIDGRADLEDISTRIBUTIONURL environment variable to https://services.gradle.org/distributions/gradle-2.14.1-all.zip
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-3160?
CVE-2017-3160 is considered to have a medium severity level due to the potential for a Man-in-the-Middle (MitM) attack.
How do I fix CVE-2017-3160?
To fix CVE-2017-3160, you should update your Apache Cordova Android version to 6.1.3 or later, where the vulnerability is addressed.
What types of attacks does CVE-2017-3160 make vulnerable?
CVE-2017-3160 makes systems vulnerable to Man-in-the-Middle (MitM) attacks during the Gradle fetch process.
Which versions of Apache Cordova Android are affected by CVE-2017-3160?
CVE-2017-3160 affects Apache Cordova Android versions earlier than 6.1.3.
Is CVE-2017-3160 specific to certain Android devices?
CVE-2017-3160 is a vulnerability that affects any Android application built using affected versions of Apache Cordova.