Full Disclosure mailing list archives
[CVE-2014-0072] Apache Cordova File-Transfer insecure defaults
From: Ian Clelland <iclelland () chromium org>
Date: Tue, 4 Mar 2014 09:06:12 -0500
CVE-2014-0072: Apache Cordova File-Transfer insecure defaults Severity: Important Vendor: The Apache Software Foundation Versions Affected: Cordova File-Transfer iOS plugin from Cordova versions 2.4.0 to 2.9.0 Cordova File-Transfer iOS standalone plugin (org.apache.cordova.file-transfer) versions 0.1.0 to 0.4.1 Description: The default value of the trustAllHosts was set to true on iOS. This has been the case since Cordova 2.4.0 and has now been rectified in the latest version of the plugin (v0.4.2). We recommend affected projects update their plugin, or work around the issue by explicitly setting the parameter to false when using the FileTransfer API. Upgrade path: Developers using the File-Transfer plugin in their applications should upgrade to version 0.4.2 Credit: This issue was discovered by Neil Bergman of Cigital, Inc.
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- [CVE-2014-0072] Apache Cordova File-Transfer insecure defaults Ian Clelland (Mar 05)