CVE-2014-1883
Last modified
CVE-2014-1883 is a vulnerability of currently unknown severity. Adobe PhoneGap before 2.6.0 on Android uses the shouldOverrideUrlLoading callback instead of the proper shouldInterceptRequest callback, which allows remote attackers to bypass intended device-resource restrictions via content that is accessed (1) in an IFRAME element or (2) with the XMLHttpRequest method by a crafted application.. EPSS estimates a 4.16% chance of exploitation in the next 30 days.
Description
Adobe PhoneGap before 2.6.0 on Android uses the shouldOverrideUrlLoading callback instead of the proper shouldInterceptRequest callback, which allows remote attackers to bypass intended device-resource restrictions via content that is accessed (1) in an IFRAME element or (2) with the XMLHttpRequest method by a crafted application.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Adobe | Phonegap | <= 2.5.0 | — |
| Adobe | Phonegap | 2.0.0 | — |
| Adobe | Phonegap | 2.1.0 | — |
| Adobe | Phonegap | 2.2.0 | — |
| Adobe | Phonegap | 2.3.0 | — |
| Adobe | Phonegap | 2.4.0 | — |
| Adobe | Phonegap | 2.5.0 | Rc1 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2014-1883?
How severe is CVE-2014-1883?
How do I fix CVE-2014-1883?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2014
- CVE-2014-1876The unpacker::redirect_stdio function in unpack.cpp in unpac…
- CVE-2014-1877Multiple cross-site scripting (XSS) vulnerabilities in Dokeo…
- CVE-2014-1878Stack-based buffer overflow in the cmd_submitf function in c…
- CVE-2014-1879Cross-site scripting (XSS) vulnerability in import.php in ph…
- CVE-2014-1881Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 an…
- CVE-2014-1882Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 an…
- CVE-2014-1884Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 an…
- CVE-2014-1885The ForzeArmate application for Android, when Adobe PhoneGap…
- CVE-2014-1886The Edinburgh by Bus application for Android, when Adobe Pho…
- CVE-2014-1887The DrinkedIn BarFinder application for Android, when Adobe …
- CVE-2014-1888Cross-site scripting (XSS) vulnerability in the BuddyPress p…
- CVE-2014-1889The Group creation process in the Buddypress plugin before 1…
Are you affected by CVE-2014-1883?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST