CVE-2014-0072

ios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin (org.apache.cordova.file-transfer) before 0.4.2 for iOS and the File-Transfer plugin for iOS from Cordova 2.4.0 through 2.9.0 might allow remote attackers to spoof SSL servers by leveraging a default value of true for the trustAllHosts option.
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:cordova_file_transfer:*:*:*:*:*:iphone_os:*:*

Configuration 2 (hide)

cpe:2.3:a:apache:cordova:*:*:*:*:*:iphone_os:*:*

History

07 Nov 2023, 02:18

Type Values Removed Values Added
References
  • {'url': 'https://mail-archives.apache.org/mod_mbox/cordova-dev/201403.mbox/%3CCAK_TSXKL9JtkehHC0jEoRwdvVKXt-d5uj40EwNY-Gk3ttX=wJw@mail.gmail.com%3E', 'name': '[cordova-dev] 20140304 [CVE-2014-0072] Apache Cordova File-Transfer insecure defaults', 'tags': ['Issue Tracking', 'Mailing List', 'Vendor Advisory'], 'refsource': 'MLIST'}
  • () https://mail-archives.apache.org/mod_mbox/cordova-dev/201403.mbox/%3CCAK_TSXKL9JtkehHC0jEoRwdvVKXt-d5uj40EwNY-Gk3ttX=wJw%40mail.gmail.com%3E -

Information

Published : 2017-10-30 19:29

Updated : 2024-02-28 16:04


NVD link : CVE-2014-0072

Mitre link : CVE-2014-0072

CVE.ORG link : CVE-2014-0072


JSON object : View

Products Affected

apache

  • cordova
  • cordova_file_transfer
CWE
CWE-20

Improper Input Validation