CVE-2017-3160

Severity: high (CVSS 7.4 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-02-01 · updated 2026-06-17

Description

After the Android platform is added to Cordova the first time, or after a project is created using the build scripts, the scripts will fetch Gradle on the first build. However, since the default URI is not using https, it is vulnerable to a MiTM and the Gradle executable is not safe. The severity of this issue is high due to the fact that the build scripts immediately start a build after Gradle has been fetched. Developers who are concerned about this issue should install version 6.1.2 or higher of Cordova-Android. If developers are unable to install the latest version, this vulnerability can easily be mitigated by setting the CORDOVA_ANDROID_GRADLE_DISTRIBUTION_URL environment variable to https://services.gradle.org/distributions/gradle-2.14.1-all.zip

Affected products

Apache Software Foundation Apache Cordova Android: before 6.1.2 — fixed in 6.1.2

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Cordova Android 6.1.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2017-3160 or the next vulnerability affects your stack