What is CVE-2015-1835?

CVE-2015-1835 is a medium-severity vulnerability in Apache Cordova, classified under Improper Input Validation. CVSS score: 5.3/10. Published 2017-10-27.

How severe is CVE-2015-1835?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Improper input validation in Apache Cordova

CVE-2015-1835

Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in config.xml, allows remote attackers to modify undefined secondary configuration variables (preferences) via a crafted intent: URL.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.059 (92.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N.

Affected products

Apache Cordova — versions 4.0.0, 4.0.1
N/a — versions n/a

Weakness classification (CWE)

CWE-20 — Improper Input Validation

References

secalert@redhat.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
secalert@redhat.com (Technical Description, Exploit, Third Party Advisory, x_refsource_MISC)
secalert@redhat.com (x_refsource_CONFIRM, Release Notes, Vendor Advisory)

Frequently asked questions

What is CVE-2015-1835?: CVE-2015-1835 is a medium-severity vulnerability in Apache Cordova, classified under Improper Input Validation. CVSS score: 5.3/10. Published 2017-10-27.
How severe is CVE-2015-1835?: Medium severity. CVSS v3 base score is 5.3 out of 10.