CVE-2014-0073

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 8.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-10-30 · updated 2026-06-17
Weakness: CWE-264

Description

The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin (org.apache.cordova.inappbrowser) before 0.3.2 for iOS and the In-App-Browser plugin for iOS from Cordova 2.6.0 through 2.9.0 does not properly validate callback identifiers, which allows remote attackers to execute arbitrary JavaScript in the host page and consequently gain privileges via a crafted gap-iab: URI.

Affected products

Apache Software Foundation Apache Cordova Android: from 2.6.0 through 2.9.0
Apache Cordova In-App-Browser: through 0.3.1

References

http://d3adend.org/blog/?p=403
http://seclists.org/fulldisclosure/2014/Mar/30
http://www.securityfocus.com/archive/1/531334/100/0/threaded
http://www.securityfocus.com/bid/65959
https://exchange.xforce.ibmcloud.com/vulnerabilities/91560
https://github.com/apache/cordova-plugin-inappbrowser/commit/26702cb0720c5c394b407c23570136c53171fa55
https://mail-archives.apache.org/mod_mbox/cordova-dev/201403.mbox/%3CCAK_TSXLGJag5Q9ATUCbFtkWvMWX9XnC80kKp-HKi25gPcvV4gw%40mail.gmail.com%3E
http://d3adend.org/blog/?p=403
http://seclists.org/fulldisclosure/2014/Mar/30
http://www.securityfocus.com/archive/1/531334/100/0/threaded
http://www.securityfocus.com/bid/65959
https://exchange.xforce.ibmcloud.com/vulnerabilities/91560

Get alerted when CVE-2014-0073 or the next vulnerability affects your stack