CVE-2019-0219

CRITICAL9.8EPSS 8.9%

Privilege Escalation in cordova-plugin-inappbrowser

發布日:2020/9/4修改日:2023/11/8
也稱為:GHSA-c6pw-q7f2-97hv

描述

Versions of `cordova-plugin-inappbrowser` prior to 3.1.0 are vulnerable to Privilege Escalation. A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a specially crafted gap-iab: URI. This affects Cordova Android applications using the package. ## Recommendation Upgrade to version 3.1.0 or later.

受影響套件(1)

CVSS 分數

來源版本嚴重程度向量
osvCVSS 3.1CRITICAL9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

參考連結(8)