high8.6
CVE-2018-16202
Path Traversal in cordova-plugin-ionic-webview
Impact
Versions of `cordova-plugin-ionic-webview` prior to 2.2.0 are vulnerable to Path Traversal, allowing attackers access to OS local files that should be inaccessible by third-party applications. The package launches a webserver listening on http://localhost:8080 without restricting access of the app itself, thus escaping the iOS application sandbox and accessing local files. ## Recommendation Upgrade to version 2.2.0
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | cordova-plugin-ionic-webview | < 2.2.0 | 2.2.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ionicframework | Ionic Web View | through 1.2.1 from 2.0.1 before 2.2.0 Version 2.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://jvn.jp/en/jp/JVN60497148/index.html
- https://github.com/ionic-team/cordova-plugin-ionic-webview
- https://jvn.jp/en/jp/JVN69812763/index.html
- https://www.npmjs.com/advisories/746
- https://github.com/advisories/GHSA-xwjh-cp99-cj8q
- https://nvd.nist.gov/vuln/detail/CVE-2018-16202