CVE Feed

    Dashboard / CVE / CVE-2014-3501

    CVE-2014-3501

    Apache Cordova Android before 3.5.1 allows remote attackers to bypass the HTTP whitelist and connect to arbitrary servers by using JavaScript to open WebSocket connections through WebView.

    Published:Nov 15, 2014
    Last Modified:Apr 12, 2025
    EPS:Nov 15, 2014
    EPSS Score:0.01651
    CVSS Score:4.3

    Affected Products

    Vendor
    Apache
    Product
    Cordova

    Exploits

    No exploit reference

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2021-21315 (CVSS 7.1) — The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of f…
    CVE-2020-11990 (CVSS 3.3) — We have resolved a security issue in the camera plugin that could have affected certain Cordova (Android) appl…
    CVE-2017-3160 (CVSS 7.4) — After the Android platform is added to Cordova the first time, or after a project is created using the build s…
    CVE-2014-0072 (CVSS 7.5) — ios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin (org.apache.cordova.file-transfer)…
    CVE-2014-0073 (CVSS 9.8) — The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin (org.apache.cordova.inappbrow…
    CVE-2015-1835 (CVSS 5.3) — Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in …
    CVE-2016-6799 (CVSS 7.5) — Product: Apache Cordova Android 5.2.2 and earlier. The application calls methods of the Log class. Messages pa…
    CVE-2015-5208 (CVSS 4.4) — Apache Cordova iOS before 4.0.0 allows remote attackers to execute arbitrary plugins via a link.…
    CVE-2015-5207 (CVSS 5.3) — Apache Cordova iOS before 4.0.0 might allow attackers to bypass a URL whitelist protection mechanism in an app…
    CVE-2015-5256 (CVSS 4.3) — Apache Cordova-Android before 4.1.0, when an application relies on a remote server, improperly implements a Ja…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High