VulnerabilityModified
CVE-2014-1886
The Edinburgh by Bus application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently access external-storage resources, by leveraging control over one of a number of…
MEDIUM 6.8EPSS 1.47%
Does this matter?
Lower severity and a low EPSS score (1.47%). Track it; it rarely justifies an emergency change on its own.
Description
The Edinburgh by Bus application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently access external-storage resources, by leveraging control over one of a number of "obscure Eastern European dating sites."
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 1.47% probability · 72th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- edinburghtour/edinburgh by bus
- Source
- cve@mitre.org
References
- http://openwall.com/lists/oss-security/2014/02/07/9
- http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdfExploit
- http://www.internetsociety.org/ndss2014/programme#session3
- http://openwall.com/lists/oss-security/2014/02/07/9
- http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdfExploit
- http://www.internetsociety.org/ndss2014/programme#session3
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.