Arbitrary Code Execution Affecting cordova-plugin-inappbrowser package, versions <3.1.0
Threat Intelligence
EPSS
0.5% (77th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-CORDOVAPLUGININAPPBROWSER-541840
- published 14 Jan 2020
- disclosed 28 Nov 2019
- credit Sergey Bobrov
Introduced: 28 Nov 2019
CVE-2019-0219 Open this link in a new tabHow to fix?
Upgrade cordova-plugin-inappbrowser to version 3.1.0 or higher.
Overview
cordova-plugin-inappbrowser is a Cordova InAppBrowser Plugin.
Affected versions of this package are vulnerable to Arbitrary Code Execution. A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a specially crafted gap-iab: URI.
References
CVSS Scores
version 3.1