JVN#41772178
Apache Cordova vulnerable to arbitrary plugin execution

Overview

Apache Cordova contains a vulnerability where arbitrary plugins may be executed.

Products Affected

• Cordova iOS versions 3.9.2 and earlier

Description

Apache Cordova provided by the Apache Software Foundation is a framework for creating mobile applications for various platforms.
iOS applications built using Apache Cordova contain a vulnerability where arbitrary plugins may be executed.

Impact

Accessing a specially crafted URL may result in arbitrary plugin execution.

Solution

Update Apache Cordova and re-build the iOS application
Developers of iOS applications should update Apache Cordova to version 4.0.0 or later and re-build the application.