NVD Vulnerability Detail

CVE-2014-0072

Summary	ios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin (org.apache.cordova.file-transfer) before 0.4.2 for iOS and the File-Transfer plugin for iOS from Cordova 2.4.0 through 2.9.0 might allow remote attackers to spoof SSL servers by leveraging a default value of true for the trustAllHosts option.
Publication Date	Oct. 31, 2017, 4:29 a.m.
Registration Date	Jan. 26, 2021, 3:04 p.m.
Last Update	Nov. 21, 2024, 11:01 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:apache:cordova_file_transfer::::::iphone_os::*			0.4.1

Configuration2		or higher	or less	more than	less than
cpe:2.3:a:apache:cordova::::::iphone_os::*		2.4.0	2.9.0

Related information, measures and tools

No	URL	タグ
1	http://d3adend.org/blog/?p=403	Issue Tracking Third Party Advisory
2	http://d3adend.org/blog/?p=403	Issue Tracking Third Party Advisory
3	http://seclists.org/fulldisclosure/2014/Mar/29	Mailing List Third Party Advisory
4	http://seclists.org/fulldisclosure/2014/Mar/29	Mailing List Third Party Advisory
5	http://www.securityfocus.com/archive/1/531335/100/0/threaded
6	http://www.securityfocus.com/archive/1/531335/100/0/threaded
7	https://exchange.xforce.ibmcloud.com/vulnerabilities/91561	Issue Tracking Third Party Advisory VDB Entry
8	https://exchange.xforce.ibmcloud.com/vulnerabilities/91561	Issue Tracking Third Party Advisory VDB Entry
9	https://github.com/apache/cordova-plugin-file-transfer/commit/a1d6fc07e8a40c1b2b16f4103c403b30e1089668	Issue Tracking Patch Vendor Advisory
10	https://github.com/apache/cordova-plugin-file-transfer/commit/a1d6fc07e8a40c1b2b16f4103c403b30e1089668	Issue Tracking Patch Vendor Advisory
11	https://mail-archives.apache.org/mod_mbox/cordova-dev/201403.mbox/%3CCAK_TSXKL9JtkehHC0jEoRwdvVKXt-d5uj40EwNY-Gk3ttX=wJw%40mail.gmail.com%3E
12	https://mail-archives.apache.org/mod_mbox/cordova-dev/201403.mbox/%3CCAK_TSXKL9JtkehHC0jEoRwdvVKXt-d5uj40EwNY-Gk3ttX=wJw%40mail.gmail.com%3E

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-20	不適切な入力確認	https://cwe.mitre.org/data/definitions/20.html

JVN Vulnerability Information

Apache Cordova の File-Transfer プラグインおよび File-Transfer スタンドアローンプラグインにおける入力確認に関する脆弱性

Title	Apache Cordova の File-Transfer プラグインおよび File-Transfer スタンドアローンプラグインにおける入力確認に関する脆弱性
Summary	Apache Cordova の File-Transfer プラグインおよび File-Transfer スタンドアローンプラグインには、入力確認に関する脆弱性が存在します。
Possible impacts	情報を改ざんされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	March 4, 2014, midnight
Registration Date	Nov. 24, 2017, 2:24 p.m.
Last Update	Nov. 24, 2017, 2:24 p.m.

Affected System

Apache Software Foundation

Apache Cordova 2.4.0 から 2.9.0

cordova-plugin-file-transfer 0.4.2 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2014-0072	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0072
National Vulnerability Database (NVD)
2	CVE-2014-0072	https://nvd.nist.gov/vuln/detail/CVE-2014-0072

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

ベンダー情報

No	Name	URL
ASF Mail Archives
1	[CVE-2014-0072] Apache Cordova File-Transfer insecure defaults	https://mail-archives.apache.org/mod_mbox/cordova-dev/201403.mbox/%3CCAK_TSXKL9JtkehHC0jEoRwdvVKXt-d5uj40EwNY-Gk3ttX=wJw@mail.gmail.com%3E
GitHub
2	Fix default value for trustAllHosts on iOS (YES->NO)	https://github.com/apache/cordova-plugin-file-transfer/commit/a1d6fc07e8a40c1b2b16f4103c403b30e1089668

Change Log

No	Changed Details	Date of change
0	[2017年11月24日] 掲載	Feb. 17, 2018, 10:37 a.m.