{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2020/JVNDB-2020-000081.html",
  "dc:date": "2020-12-07T16:34+09:00",
  "dcterms:issued": "2020-12-07T16:34+09:00",
  "dcterms:modified": "2020-12-07T16:34+09:00",
  "description": "Apache Cordova Plugin camera is a plugin for Apache Cordova applications, which provides an API for taking pictures and for choosing images from the system image library.\r\nVulnerable versions of Apache Cordova Plugin camera, when used in Android applications, use the external storage on the device when available, as an image file cache. Any applications with permission READ_EXTERNAL_STORAGE (or WRITE_EXTERNAL_STORAGE also) can access these cache files(CWE-200).\r\n\r\nOn the source code repository, the commit to fix the vulnerability is done for version 4.2.0, but version 4.2.0 is not officially released. Hence the fixed version is 5.0.0.\r\n\r\nAkihiro Matsumura of Saison Information Systems Co., Ltd. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2020/JVNDB-2020-000081.html",
  "sec:cpe": {
    "#text": "cpe:/a:apache:cordova",
    "@product": "Apache Cordova",
    "@vendor": "Apache Software Foundation",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "4.3",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
      "@version": "2.0"
    },
    {
      "@score": "3.3",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2020-000081",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN59779918",
      "@id": "JVN#59779918",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11990",
      "@id": "CVE-2020-11990",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2020-11990",
      "@id": "CVE-2020-11990",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-200",
      "@title": "Information Exposure(CWE-200)"
    }
  ],
  "title": "Apache Cordova Plugin camera vulnerable to information exposure"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000058.html",
  "dc:date": "2016-06-02T17:49+09:00",
  "dcterms:issued": "2016-05-11T14:16+09:00",
  "dcterms:modified": "2016-06-02T17:49+09:00",
  "description": "Apache Cordova contains a vulnerability where whitelist restrictions are not properly applied.\r\nApache Cordova provided by the Apache Software Foundation is a framework for creating mobile applications for various platforms.\r\niOS applications built using Apache Cordova contain a vulnerability where whitelist restrictions are not properly applied.\r\n\r\nMuneaki Nishimura (nishimunea) of Recruit Technologies Co.,Ltd. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000058.html",
  "sec:cpe": {
    "#text": "cpe:/a:apache:cordova",
    "@product": "Apache Cordova",
    "@vendor": "Apache Software Foundation",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "4.3",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "4.3",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2016-000058",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN35341085/index.html",
      "@id": "JVN#35341085",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5207",
      "@id": "CVE-2015-5207",
      "@source": "CVE"
    },
    {
      "#text": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5207",
      "@id": "CVE-2015-5207",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-264",
      "@title": "Permissions(CWE-264)"
    }
  ],
  "title": "Apache Cordova fails to restrict access permissions"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-000187.html",
  "dc:date": "2015-11-27T13:29+09:00",
  "dcterms:issued": "2015-11-27T13:29+09:00",
  "dcterms:modified": "2015-11-27T13:29+09:00",
  "description": "Apache Cordova provided by the Apache Software Foundation is a framework for creating mobile applications for various platforms.\r\nAndroid applications built using Apache Cordova contain a vulnerability where whitelist restrictions are not properly applied.\r\n\r\nMuneaki Nishimura of Sony Digital Network Applications, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-000187.html",
  "sec:cpe": {
    "#text": "cpe:/a:apache:cordova",
    "@product": "Apache Cordova",
    "@vendor": "Apache Software Foundation",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "4.3",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2015-000187",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN18889193/index.html",
      "@id": "JVN#18889193",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5256",
      "@id": "CVE-2015-5256",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2015-5256",
      "@id": "CVE-2015-5256",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-264",
      "@title": "Permissions(CWE-264)"
    }
  ],
  "title": "Apache Cordova vulnerable to improper application of whitelist restrictions"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000059.html",
  "dc:date": "2016-06-01T16:30+09:00",
  "dcterms:issued": "2016-05-11T14:16+09:00",
  "dcterms:modified": "2016-06-01T16:30+09:00",
  "description": "Apache Cordova contains a vulnerability where arbitrary plugins may be executed.\r\nApache Cordova provided by the Apache Software Foundation is a framework for creating mobile applications for various platforms.\r\niOS applications built using Apache Cordova contain a vulnerability where arbitrary plugins may be executed.\r\n\r\nMuneaki Nishimura (nishimunea) of Recruit Technologies Co.,Ltd. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000059.html",
  "sec:cpe": {
    "#text": "cpe:/a:apache:cordova",
    "@product": "Apache Cordova",
    "@vendor": "Apache Software Foundation",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "6.8",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
      "@version": "2.0"
    },
    {
      "@score": "6.3",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2016-000059",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN41772178/index.html",
      "@id": "JVN#41772178",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5208",
      "@id": "CVE-2015-5208",
      "@source": "CVE"
    },
    {
      "#text": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5208",
      "@id": "CVE-2015-5208",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-20",
      "@title": "Improper Input Validation(CWE-20)"
    }
  ],
  "title": "Apache Cordova vulnerable to arbitrary plugin execution"
}