Homepage
About Snyk

cordova-plugin-file-transfer@0.3.4 vulnerabilities

Cordova File Transfer Plugin

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the cordova-plugin-file-transfer package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Insecure Defaults

cordova-plugin-file-transfer is a cordova File Transfer Plugin.

Affected version of this package are vulnerable to Insecure Defaults. ios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin (org.apache.cordova.file-transfer) before 0.4.2 for iOS and the File-Transfer plugin for iOS from Cordova 2.4.0 through 2.9.0 might allow remote attackers to spoof SSL servers by leveraging a default value of true for the trustAllHosts option.

How to fix Insecure Defaults?

Upgrade cordova-plugin-file-transfer to version 0.4.2 or higher.

<0.4.2
  • M
CRLF Injection

cordova-plugin-file-transfer is a Cordova File Transfer Plugin.

Affected versions of the package are vulnerable to CRLF Injection. This allows remote attackers to inject arbitrary headers via CRLF sequences in the filename of an uploaded file.

How to fix CRLF Injection?

Upgrade cordova-plugin-file-transfer to version 1.3.0 or higher.

<1.3.0
Go back to all versions of this package