CVE Feed

    Dashboard / CVE / CVE-2015-5256

    CVE-2015-5256

    Apache Cordova-Android before 4.1.0, when an application relies on a remote server, improperly implements a JavaScript whitelist protection mechanism, which allows attackers to bypass intended access restrictions via a crafted URI.

    Published:Nov 23, 2015
    Last Modified:Apr 12, 2025
    EPS:Nov 23, 2015
    EPSS Score:0.00705
    CVSS Score:4.3

    Affected Products

    Vendor
    Apache
    Product
    Cordova

    Exploits

    No exploit reference

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2021-21315 (CVSS 7.1) — The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of f…
    CVE-2020-11990 (CVSS 3.3) — We have resolved a security issue in the camera plugin that could have affected certain Cordova (Android) appl…
    CVE-2017-3160 (CVSS 7.4) — After the Android platform is added to Cordova the first time, or after a project is created using the build s…
    CVE-2014-0072 (CVSS 7.5) — ios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin (org.apache.cordova.file-transfer)…
    CVE-2014-0073 (CVSS 9.8) — The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin (org.apache.cordova.inappbrow…
    CVE-2015-1835 (CVSS 5.3) — Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in …
    CVE-2016-6799 (CVSS 7.5) — Product: Apache Cordova Android 5.2.2 and earlier. The application calls methods of the Log class. Messages pa…
    CVE-2015-5208 (CVSS 4.4) — Apache Cordova iOS before 4.0.0 allows remote attackers to execute arbitrary plugins via a link.…
    CVE-2015-5207 (CVSS 5.3) — Apache Cordova iOS before 4.0.0 might allow attackers to bypass a URL whitelist protection mechanism in an app…
    CVE-2015-8320 (CVSS 5) — Apache Cordova-Android before 3.7.0 improperly generates random values for BridgeSecret data, which makes it e…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High