CVE Feed

    Dashboard / CVE / CVE-2020-11990

    CVE-2020-11990

    We have resolved a security issue in the camera plugin that could have affected certain Cordova (Android) applications. An attacker who could install (or lead the victim to install) a specially crafted (or malicious) Android application would be able to access pictures taken with the app externally.

    Published:Dec 1, 2020
    Last Modified:Nov 21, 2024
    EPS:Dec 1, 2020
    EPSS Score:0.00158
    CVSS Score:3.3

    Affected Products

    Vendor
    Apache
    Product
    Cordova

    Exploits

    https://github.com/forse01/CVE-2020-11990-Cordova

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2021-21315 (CVSS 7.1) — The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of f…
    CVE-2017-3160 (CVSS 7.4) — After the Android platform is added to Cordova the first time, or after a project is created using the build s…
    CVE-2014-0072 (CVSS 7.5) — ios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin (org.apache.cordova.file-transfer)…
    CVE-2014-0073 (CVSS 9.8) — The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin (org.apache.cordova.inappbrow…
    CVE-2015-1835 (CVSS 5.3) — Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in …
    CVE-2016-6799 (CVSS 7.5) — Product: Apache Cordova Android 5.2.2 and earlier. The application calls methods of the Log class. Messages pa…
    CVE-2015-5208 (CVSS 4.4) — Apache Cordova iOS before 4.0.0 allows remote attackers to execute arbitrary plugins via a link.…
    CVE-2015-5207 (CVSS 5.3) — Apache Cordova iOS before 4.0.0 might allow attackers to bypass a URL whitelist protection mechanism in an app…
    CVE-2015-5256 (CVSS 4.3) — Apache Cordova-Android before 4.1.0, when an application relies on a remote server, improperly implements a Ja…
    CVE-2015-8320 (CVSS 5) — Apache Cordova-Android before 3.7.0 improperly generates random values for BridgeSecret data, which makes it e…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High