CVE-2017-3160

low-risk
Published 2018-02-01

After the Android platform is added to Cordova the first time, or after a project is created using the build scripts, the scripts will fetch Gradle on the first build. However, since the default URI is not using https, it is vulnerable to a MiTM and the Gradle executable is not safe. The severity of this issue is high due to the fact that the build scripts immediately start a build after Gradle has been fetched. Developers who are concerned about this issue should install version 6.1.2 or higher of Cordova-Android. If developers are unable to install the latest version, this vulnerability can easily be mitigated by setting the CORDOVA_ANDROID_GRADLE_DISTRIBUTION_URL environment variable to https://services.gradle.org/distributions/gradle-2.14.1-all.zip

Do I need to act?

-
0.34% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.4/10 High
NETWORK / HIGH complexity

Affected Products (1)

Affected Vendors

Apache

References (6)

Third Party Advisory http://www.securityfocus.com/bid/95838
Mitigation https://cordova.apache.org/announcements/2017/01/27/android-612.html
https://www.oracle.com/security-alerts/cpuapr2020.html
Third Party Advisory http://www.securityfocus.com/bid/95838
Mitigation https://cordova.apache.org/announcements/2017/01/27/android-612.html
https://www.oracle.com/security-alerts/cpuapr2020.html
28
/ 100
low-risk
Severity 22/34 · High
Exploitability 1/34 · Minimal
Exposure 5/34 · Minimal