CVE-2014-0072 Security feature bypass in n/a

What is CVE-2014-0072?

CVE-2014-0072 is a high-severity vulnerability in n/a, published on 30 Oct 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

ios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin (org.apache.cordova.file-transfer) before 0.4.2 for iOS and the File-Transfer plugin for iOS from Cordova 2.4.0 through 2.9.0 might allow remote attackers to spoof SSL servers by leveraging a default value of true for the trustAllHosts option.

Weakness: CWE-20

Which versions are affected by CVE-2014-0072?

It affects 2 products.

Products include Apache Cordova, Apache Cordova File Transfer.

How do I fix CVE-2014-0072?

No fix has been published for CVE-2014-0072 yet. Limit exposure of the affected software until one is available.

Is CVE-2014-0072 being exploited?

There is no known exploitation of CVE-2014-0072 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2021-21315 System Information Library for Node.JS Command Injection Exploited High 7.1
• CVE-2014-0073 Cross-site scripting in n/a Critical 9.8
• CVE-2016-6799 Information Exposure in cordova-android High 7.5
• CVE-2017-3160 Supply chain in Apache Cordova Android High 7.4
• CVE-2014-3500 Other in n/a Medium 6.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vgg8-4wp9-8p4c.