~ / search / GHSA-xwjh-cp99-cj8q

GHSA-xwjh-cp99-cj8q

Path Traversal in cordova-plugin-ionic-webview

Source: GitHub Advisory Database (reviewed) High CVE-2018-16202

Packages

EcosystemPackageAffectedFixed in
npm cordova-plugin-ionic-webview < 2.2.0 2.2.0

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of `cordova-plugin-ionic-webview` prior to 2.2.0 are vulnerable to Path Traversal, allowing attackers access to OS local files that should be inaccessible by third-party applications. The package launches a webserver listening on http://localhost:8080 without restricting access of the app itself, thus escaping the iOS application sandbox and accessing local files. ## Recommendation Upgrade to version 2.2.0

References

External links from the advisory. They lead to third-party sites.