CVE-2014-0073 json
The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin (org.apache.cordova.inappbrowser) before 0.3.2 for iOS and…
published 2017-10-30 9 y ago modified 2026-06-17 4 mo ago also EUVD-2014-0166
- cvss
- 9.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 8.3%
- EPSS 8.3% chance of exploitation in 30 days, percentile 94%
- public exploits
- 0
- none known
Summary
The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin (org.apache.cordova.inappbrowser) before 0.3.2 for iOS and the In-App-Browser plugin for iOS from Cordova 2.6.0 through 2.9.0 does not properly validate callback identifiers, which allows remote attackers to execute arbitrary JavaScript in the host page and consequently gain privileges via a crafted gap-iab: URI.
Patch / fix
Exploit prediction
8.28% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Classification
- Weakness
-
- CWE-264 Permissions, Privileges, and Access Controls
References
-
github.com
/apache/cordova-plugin-inappbrowser/commit/26702cb0720c5c394b407c23570136c53171fa55
issue-tracking, patch, vendor-advisory
-
securityfocus.com
/archive/1/531334/100/0/threaded
mailing-list
-
securityfocus.com
/bid/65959
vdb-entry, third-party-advisory
-
d3adend.org
/blog/?p=403
issue-tracking, third-party-advisory
-
mail-archives.apache.org
/mod_mbox/cordova-dev/201403.mbox/%3CCAK_TSXLGJag5Q9ATUCbFtkWvMWX9XnC80kKp-HKi25gPcvV4gw%40mail.gmail.com%3E
mailing-list
-
exchange.xforce.ibmcloud.com
/vulnerabilities/91560
vdb-entry, issue-tracking, third-party-advisory
-
seclists.org
/fulldisclosure/2014/Mar/30
mailing-list, third-party-advisory
Sources
- CVE List CVE-2014-0073
- NVD CVE-2014-0073
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.