CVE-2017-3160
Last modified
CVE-2017-3160 is a vulnerability of currently unknown severity. After the Android platform is added to Cordova the first time, or after a project is created using the build scripts, the scripts will fetch Gradle on the first build. However, since the default URI is not using https, it is vulnerable to a MiTM and the Gradle executable is not safe. EPSS estimates a 3.82% chance of exploitation in the next 30 days.
Description
After the Android platform is added to Cordova the first time, or after a project is created using the build scripts, the scripts will fetch Gradle on the first build. However, since the default URI is not using https, it is vulnerable to a MiTM and the Gradle executable is not safe. The severity of this issue is high due to the fact that the build scripts immediately start a build after Gradle has been fetched. Developers who are concerned about this issue should install version 6.1.2 or higher of Cordova-Android. If developers are unable to install the latest version, this vulnerability can easily be mitigated by setting the CORDOVA_ANDROID_GRADLE_DISTRIBUTION_URL environment variable to https://services.gradle.org/distributions/gradle-2.14.1-all.zip
Metrics
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Cordova | < 6.1.2 |
References
- http://www.securityfocus.com/bid/95838Third Party Advisory, VDB Entry
- https://cordova.apache.org/announcements/2017/01/27/android-612.htmlMitigation, Vendor Advisory
- http://www.securityfocus.com/bid/95838Third Party Advisory, VDB Entry
- https://cordova.apache.org/announcements/2017/01/27/android-612.htmlMitigation, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-3160?
How severe is CVE-2017-3160?
How do I fix CVE-2017-3160?
Are you affected by CVE-2017-3160?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST