Information from The Apache Software Foundation
Vulnerability ID:JVN#18889193
Title:Apache Cordova vulnerable to improper application of whitelist restrictions
Status:Vulnerable
This is a statement from the vendor itself with no modification by JPCERT/CC.
CVE-2015-5256: Apache Cordova vulnerable to improper application of whitelist restrictions on Android
Severity: Medium
Vendor: The Apache Software Foundation
Versions Affected: Cordova Android 3.7.2 and earlier
Description: Android applications created using Apache Cordova that use a remote server contain a vulnerability where whitelist restrictions are not properly applied. Improperly crafted URIs could be used to circumvent the whitelist, allowing for the execution of non-whitelisted Javascript.
Upgrade path: Developers who are concerned about this should rebuild their applications with Cordova Android 4.1.1. Developers using remote content roots should also use SSL, as well as Content Source Policy to further mitigate this issue.
Credit: Muneaki Nishimura of Sony Digital Network Applications, Inc
