Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Cordova and PhoneGap on Windows Phone allow navigation bypass

CVE-2014-1884 · published 12 years ago
Summary

Versions of Apache Cordova up to 3.3.0 and Adobe PhoneGap up to 2.9.0 on Windows Phone 7 and 8 do not correctly limit where a web page can navigate. An attacker could craft content in a frame or a data request that makes the app access resources it should not be allowed to use. Update to newer versions of Cordova or PhoneGap, or apply patches that enforce proper navigation restrictions.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
apache cordova <= 3.3.0
3.0.0
3.1.0
3.2.0
3.3.0
cpe:2.3:a:apache:cordova:*:*:*:*:*:*:*:*
adobe phonegap <= 2.9.0
2.0.0
2.1.0
2.2.0
2.3.0
2.4.0
2.5.0
2.6.0
2.7.0
2.8.0
2.8.1
2.9.0
cpe:2.3:a:adobe:phonegap:*:*:*:*:*:*:*:*
Original advisory text
Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier on Windows Phone 7 and 8 do not properly restrict navigation events, which allows remote attackers to bypass intended device-re...
Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier on Windows Phone 7 and 8 do not properly restrict navigation events, which allows remote attackers to bypass intended device-resource restrictions via content that is accessed (1) in an IFRAME element or (2) with the XMLHttpRequest method by a crafted application.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
8% chance of attack within 30 days
Type
CWE-264Permissions, Privileges, and Access Controls
Timeline
Published3 Mar 2014
Updated15 Oct 2026
First seen29 Sep 2026
Sources
CVE-2014-1884 · NVD
Track software like this
Free during beta