Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2012-6637

Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier do not anchor the end of domain-name regular expressions, which allows remote attackers to bypass a whitelist protection mechanism via a domain name that contains an acceptable name as an initial substring.

Published

2014-03-03T04:50:46.203

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-20
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application apache cordova ≤ 3.3.0 Yes
Application apache cordova 3.0.0 Yes
Application apache cordova 3.0.0 Yes
Application apache cordova 3.1.0 Yes
Application apache cordova 3.1.0 Yes
Application apache cordova 3.2.0 Yes
Application apache cordova 3.2.0 Yes
Application apache cordova 3.3.0 Yes
Application adobe phonegap ≤ 2.9.0 Yes
Application adobe phonegap 2.0.0 Yes
Application adobe phonegap 2.0.0 Yes
Application adobe phonegap 2.1.0 Yes
Application adobe phonegap 2.2.0 Yes
Application adobe phonegap 2.2.0 Yes
Application adobe phonegap 2.2.0 Yes
Application adobe phonegap 2.3.0 Yes
Application adobe phonegap 2.3.0 Yes
Application adobe phonegap 2.3.0 Yes
Application adobe phonegap 2.4.0 Yes
Application adobe phonegap 2.4.0 Yes
Application adobe phonegap 2.5.0 Yes
Application adobe phonegap 2.5.0 Yes
Application adobe phonegap 2.6.0 Yes
Application adobe phonegap 2.6.0 Yes
Application adobe phonegap 2.7.0 Yes
Application adobe phonegap 2.7.0 Yes
Application adobe phonegap 2.8.0 Yes
Application adobe phonegap 2.8.1 Yes
Application adobe phonegap 2.9.0 Yes
References