CVE-2017-3160
However, since the default URI is not using https, it is vulnerable to a MiTM and the Gradle executable is not safe.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.75%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
After the Android platform is added to Cordova the first time, or after a project is created using the build scripts, the scripts will fetch Gradle on the first build. However, since the default URI is not using https, it is vulnerable to a MiTM and the Gradle executable is not safe. The severity of this issue is high due to the fact that the build scripts immediately start a build after Gradle has been fetched. Developers who are concerned about this issue should install version 6.1.2 or higher of Cordova-Android. If developers are unable to install the latest version, this vulnerability can easily be mitigated by setting the CORDOVA_ANDROID_GRADLE_DISTRIBUTION_URL environment variable to https://services.gradle.org/distributions/gradle-2.14.1-all.zip
- CVSS 3.0
- 7.4 HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- EPSS
- 3.75% probability · 89th percentile
- CISA KEV
- Not listed
- Affected
- apache/cordova
- Source
- security@apache.org
References
- http://www.securityfocus.com/bid/95838Third Party Advisory, VDB Entry
- https://cordova.apache.org/announcements/2017/01/27/android-612.htmlMitigation, Vendor Advisory
- https://www.oracle.com/security-alerts/cpuapr2020.html
- http://www.securityfocus.com/bid/95838Third Party Advisory, VDB Entry
- https://cordova.apache.org/announcements/2017/01/27/android-612.htmlMitigation, Vendor Advisory
- https://www.oracle.com/security-alerts/cpuapr2020.html
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.