Home page logo

bugtraq logo Bugtraq mailing list archives

[CVE-2014-0072] Apache Cordova File-Transfer insecure defaults
From: iclelland () chromium org
Date: Tue, 4 Mar 2014 13:50:07 GMT

CVE-2014-0072: Apache Cordova File-Transfer insecure defaults

Severity: Important

The Apache Software Foundation

Versions Affected:
Cordova File-Transfer iOS plugin from Cordova versions 2.4.0 to 2.9.0
Cordova File-Transfer iOS standalone plugin (org.apache.cordova.file-transfer) versions 0.1.0 to 0.4.1

The default value of the trustAllHosts was set to true on iOS. This has
been the case since Cordova 2.4.0 and has now been rectified in the latest
version of the plugin (v0.4.2). We recommend affected projects update their
plugin, or work around the issue by explicitly setting the parameter to
false when using the FileTransfer API.

Upgrade path:
Developers using the File-Transfer plugin in their applications should
upgrade to version 0.4.2

This issue was discovered by Neil Bergman of Cigital, Inc.  

  By Date           By Thread  

Current thread:
  • [CVE-2014-0072] Apache Cordova File-Transfer insecure defaults iclelland (Mar 04)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]