{"api_version":"1","generated_at":"2026-07-24T20:47:50+00:00","cve":"CVE-2014-0073","urls":{"html":"https://cve.report/CVE-2014-0073","api":"https://cve.report/api/cve/CVE-2014-0073.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-0073","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-0073"},"summary":{"title":"CVE-2014-0073","description":"The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin (org.apache.cordova.inappbrowser) before 0.3.2 for iOS and the In-App-Browser plugin for iOS from Cordova 2.6.0 through 2.9.0 does not properly validate callback identifiers, which allows remote attackers to execute arbitrary JavaScript in the host page and consequently gain privileges via a crafted gap-iab: URI.","state":"PUBLISHED","assigner":"redhat","published_at":"2017-10-30 19:29:00","updated_at":"2025-04-20 01:37:25"},"problem_types":["CWE-264","n/a"],"metrics":[{"version":"3.0","source":"nvd@nist.gov","type":"Primary","score":"9.8","severity":"CRITICAL","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"https://mail-archives.apache.org/mod_mbox/cordova-dev/201403.mbox/%3CCAK_TSXLGJag5Q9ATUCbFtkWvMWX9XnC80kKp-HKi25gPcvV4gw%40mail.gmail.com%3E","name":"https://mail-archives.apache.org/mod_mbox/cordova-dev/201403.mbox/%3CCAK_TSXLGJag5Q9ATUCbFtkWvMWX9XnC80kKp-HKi25gPcvV4gw%40mail.gmail.com%3E","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"[CVE-2014-0073] Apache Cordova In-App-Browser privilege escalation","mime":"text/xml","httpstatus":"200","archivestatus":"200"},{"url":"http://seclists.org/fulldisclosure/2014/Mar/30","name":"http://seclists.org/fulldisclosure/2014/Mar/30","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"title":"Full Disclosure: [CVE-2014-0073] Apache Cordova In-App-Browser\tprivilege escalation","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/531334/100/0/threaded","name":"http://www.securityfocus.com/archive/1/531334/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://d3adend.org/blog/?p=403","name":"http://d3adend.org/blog/?p=403","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Third Party Advisory"],"title":"Cordova InAppBrowser Remote Privilege Escalation | dead && end","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/apache/cordova-plugin-inappbrowser/commit/26702cb0720c5c394b407c23570136c53171fa55","name":"https://github.com/apache/cordova-plugin-inappbrowser/commit/26702cb0720c5c394b407c23570136c53171fa55","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch","Vendor Advisory"],"title":"Validate that callbackId is correctly formed · apache/cordova-plugin-inappbrowser@26702cb · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/91560","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/91560","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Third Party Advisory","VDB Entry"],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/65959","name":"http://www.securityfocus.com/bid/65959","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Apache Cordova InAppBrowser Remote Privilege Escalation Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://mail-archives.apache.org/mod_mbox/cordova-dev/201403.mbox/%3CCAK_TSXLGJag5Q9ATUCbFtkWvMWX9XnC80kKp-HKi25gPcvV4gw@mail.gmail.com%3E","name":"MLIST:[cordova-dev] 20140304 [CVE-2014-0073] Apache Cordova In-App-Browser privilege escalation","refsource":"MITRE","tags":[],"title":"[CVE-2014-0073] Apache Cordova In-App-Browser privilege escalation","mime":"text/xml","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0073","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0073","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"73","vulnerable":"1","versionEndIncluding":"2.9.0","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"apache","cpe5":"cordova","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"iphone_os","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"73","vulnerable":"1","versionEndIncluding":"0.3.1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"apache","cpe5":"cordova_in-app-browser","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"iphone_os","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T09:05:37.064Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"20140304 [CVE-2014-0073] Apache Cordova In-App-Browser privilege escalation","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/531334/100/0/threaded"},{"name":"65959","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/65959"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://d3adend.org/blog/?p=403"},{"name":"[cordova-dev] 20140304 [CVE-2014-0073] Apache Cordova In-App-Browser privilege escalation","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"https://mail-archives.apache.org/mod_mbox/cordova-dev/201403.mbox/%3CCAK_TSXLGJag5Q9ATUCbFtkWvMWX9XnC80kKp-HKi25gPcvV4gw%40mail.gmail.com%3E"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://github.com/apache/cordova-plugin-inappbrowser/commit/26702cb0720c5c394b407c23570136c53171fa55"},{"name":"apache-cordova-cve20140073-priv-esc(91560)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/91560"},{"name":"20140304 [CVE-2014-0073] Apache Cordova In-App-Browser privilege escalation","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"],"url":"http://seclists.org/fulldisclosure/2014/Mar/30"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2014-03-03T00:00:00.000Z","descriptions":[{"lang":"en","value":"The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin (org.apache.cordova.inappbrowser) before 0.3.2 for iOS and the In-App-Browser plugin for iOS from Cordova 2.6.0 through 2.9.0 does not properly validate callback identifiers, which allows remote attackers to execute arbitrary JavaScript in the host page and consequently gain privileges via a crafted gap-iab: URI."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-09T18:57:01.000Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"name":"20140304 [CVE-2014-0073] Apache Cordova In-App-Browser privilege escalation","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/531334/100/0/threaded"},{"name":"65959","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/65959"},{"tags":["x_refsource_MISC"],"url":"http://d3adend.org/blog/?p=403"},{"name":"[cordova-dev] 20140304 [CVE-2014-0073] Apache Cordova In-App-Browser privilege escalation","tags":["mailing-list","x_refsource_MLIST"],"url":"https://mail-archives.apache.org/mod_mbox/cordova-dev/201403.mbox/%3CCAK_TSXLGJag5Q9ATUCbFtkWvMWX9XnC80kKp-HKi25gPcvV4gw%40mail.gmail.com%3E"},{"tags":["x_refsource_CONFIRM"],"url":"https://github.com/apache/cordova-plugin-inappbrowser/commit/26702cb0720c5c394b407c23570136c53171fa55"},{"name":"apache-cordova-cve20140073-priv-esc(91560)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/91560"},{"name":"20140304 [CVE-2014-0073] Apache Cordova In-App-Browser privilege escalation","tags":["mailing-list","x_refsource_FULLDISC"],"url":"http://seclists.org/fulldisclosure/2014/Mar/30"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"secalert@redhat.com","ID":"CVE-2014-0073","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin (org.apache.cordova.inappbrowser) before 0.3.2 for iOS and the In-App-Browser plugin for iOS from Cordova 2.6.0 through 2.9.0 does not properly validate callback identifiers, which allows remote attackers to execute arbitrary JavaScript in the host page and consequently gain privileges via a crafted gap-iab: URI."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"20140304 [CVE-2014-0073] Apache Cordova In-App-Browser privilege escalation","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/531334/100/0/threaded"},{"name":"65959","refsource":"BID","url":"http://www.securityfocus.com/bid/65959"},{"name":"http://d3adend.org/blog/?p=403","refsource":"MISC","url":"http://d3adend.org/blog/?p=403"},{"name":"[cordova-dev] 20140304 [CVE-2014-0073] Apache Cordova In-App-Browser privilege escalation","refsource":"MLIST","url":"https://mail-archives.apache.org/mod_mbox/cordova-dev/201403.mbox/%3CCAK_TSXLGJag5Q9ATUCbFtkWvMWX9XnC80kKp-HKi25gPcvV4gw@mail.gmail.com%3E"},{"name":"https://github.com/apache/cordova-plugin-inappbrowser/commit/26702cb0720c5c394b407c23570136c53171fa55","refsource":"CONFIRM","url":"https://github.com/apache/cordova-plugin-inappbrowser/commit/26702cb0720c5c394b407c23570136c53171fa55"},{"name":"apache-cordova-cve20140073-priv-esc(91560)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/91560"},{"name":"20140304 [CVE-2014-0073] Apache Cordova In-App-Browser privilege escalation","refsource":"FULLDISC","url":"http://seclists.org/fulldisclosure/2014/Mar/30"}]}}}},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2014-0073","datePublished":"2017-10-30T19:00:00.000Z","dateReserved":"2013-12-03T00:00:00.000Z","dateUpdated":"2024-08-06T09:05:37.064Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2017-10-30 19:29:00","lastModifiedDate":"2025-04-20 01:37:25","problem_types":["CWE-264","n/a"],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:cordova_in-app-browser:*:*:*:*:*:iphone_os:*:*","versionEndIncluding":"0.3.1","matchCriteriaId":"F00503CE-5126-459D-A86C-4EBD03AADBDD"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:cordova:*:*:*:*:*:iphone_os:*:*","versionStartIncluding":"2.6.0","versionEndIncluding":"2.9.0","matchCriteriaId":"9A33FFF9-7ECC-4C8D-AEA6-4C33A958A3D5"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"73","Ordinal":"1","Title":"CVE-2014-0073","CVE":"CVE-2014-0073","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"73","Ordinal":"1","NoteData":"The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin (org.apache.cordova.inappbrowser) before 0.3.2 for iOS and the In-App-Browser plugin for iOS from Cordova 2.6.0 through 2.9.0 does not properly validate callback identifiers, which allows remote attackers to execute arbitrary JavaScript in the host page and consequently gain privileges via a crafted gap-iab: URI.","Type":"Description","Title":"CVE-2014-0073"},{"CveYear":"2014","CveId":"73","Ordinal":"2","NoteData":"2017-10-30","Type":"Other","Title":"Published"},{"CveYear":"2014","CveId":"73","Ordinal":"3","NoteData":"2018-10-09","Type":"Other","Title":"Modified"}]}}}