Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2014-0073 Details

Description

The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin (org.apache.cordova.inappbrowser) before 0.3.2 for iOS and the In-App-Browser plugin for iOS from Cordova 2.6.0 through 2.9.0 does not properly validate callback identifiers, which allows remote attackers to execute arbitrary JavaScript in the host page and consequently gain privileges via a crafted gap-iab: URI.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:9.8 CRITICALVector:CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
http://d3adend.org/blog/?p=403	CVE	Issue TrackingThird Party Advisory
http://seclists.org/fulldisclosure/2014/Mar/30	CVE	Mailing ListThird Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/91560	CVE	Issue TrackingThird Party AdvisoryVDB Entry
https://github.com/apache/cordova-plugin-inappbrowser/commit/26702cb0720c5c394b407c23570136c53171fa55	CVE	Issue TrackingPatchVendor Advisory
https://mail-archives.apache.org/mod_mbox/cordova-dev/201403.mbox/%3CCAK_TSXLGJag5Q9ATUCbFtkWvMWX9XnC80kKp-HKi25gPcvV4gw%40mail.gmail.com%3E	CVE
http://www.securityfocus.com/archive/1/531334/100/0/threaded	CVE
http://www.securityfocus.com/bid/65959	CVE	Third Party AdvisoryVDB Entry
http://d3adend.org/blog/?p=403	[email protected]	Issue TrackingThird Party Advisory
http://seclists.org/fulldisclosure/2014/Mar/30	[email protected]	Mailing ListThird Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/91560	[email protected]	Issue TrackingThird Party AdvisoryVDB Entry
https://github.com/apache/cordova-plugin-inappbrowser/commit/26702cb0720c5c394b407c23570136c53171fa55	[email protected]	Issue TrackingPatchVendor Advisory
https://mail-archives.apache.org/mod_mbox/cordova-dev/201403.mbox/%3CCAK_TSXLGJag5Q9ATUCbFtkWvMWX9XnC80kKp-HKi25gPcvV4gw%40mail.gmail.com%3E	[email protected]
http://www.securityfocus.com/archive/1/531334/100/0/threaded	[email protected]
http://www.securityfocus.com/bid/65959	[email protected]	Third Party AdvisoryVDB Entry

see all 14 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-264	Permissions, Privileges, and Access Controls	[email protected]

Affected Products

Product	Versions
apache cordova in-app-browser	<= 0.3.1
CPE cpe:2.3:a:apache:cordova_in-app-browser::::::iphone_os::* Remediation No remediation found in references.
apache cordova	>= 2.6.0, <= 2.9.0
CPE cpe:2.3:a:apache:cordova::::::iphone_os::* Remediation No remediation found in references.

Change History

7 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
May 13, 2026	CVE Status Change	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Nov 7, 2023	CVE Modified	[email protected]
Oct 9, 2018	CVE Modified	[email protected]
Nov 21, 2017	Initial Analysis	[email protected]