7.5

CVE-2012-6637

Exploit

Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier do not anchor the end of domain-name regular expressions, which allows remote attackers to bypass a whitelist protection mechanism via a domain name that contains an acceptable name as an initial substring.

Data is provided by the National Vulnerability Database (NVD)
Apache ≫ Cordova Version <= 3.3.0
Apache ≫ Cordova Version3.0.0
Apache ≫ Cordova Version3.0.0 Updaterc1
Apache ≫ Cordova Version3.1.0
Apache ≫ Cordova Version3.1.0 Updaterc1
Apache ≫ Cordova Version3.2.0
Apache ≫ Cordova Version3.2.0 Updaterc1
Apache ≫ Cordova Version3.3.0 Updaterc1
Adobe ≫ Phonegap Version <= 2.9.0
Adobe ≫ Phonegap Version2.0.0
Adobe ≫ Phonegap Version2.0.0 Updaterc1
Adobe ≫ Phonegap Version2.1.0
Adobe ≫ Phonegap Version2.2.0
Adobe ≫ Phonegap Version2.2.0 Updaterc1
Adobe ≫ Phonegap Version2.2.0 Updaterc2
Adobe ≫ Phonegap Version2.3.0
Adobe ≫ Phonegap Version2.3.0 Updaterc1
Adobe ≫ Phonegap Version2.3.0 Updaterc2
Adobe ≫ Phonegap Version2.4.0
Adobe ≫ Phonegap Version2.4.0 Updaterc1
Adobe ≫ Phonegap Version2.5.0
Adobe ≫ Phonegap Version2.5.0 Updaterc1
Adobe ≫ Phonegap Version2.6.0
Adobe ≫ Phonegap Version2.6.0 Updaterc1
Adobe ≫ Phonegap Version2.7.0
Adobe ≫ Phonegap Version2.7.0 Updaterc1
Adobe ≫ Phonegap Version2.8.0
Adobe ≫ Phonegap Version2.8.1
Adobe ≫ Phonegap Version2.9.0 Updaterc1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 1.27% 0.786
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.