Vulnerability · Published Dec 1, 2020 · Assigned by apache
CVE-2020-11990
Low 3.3
In plain English
A low-severity security flaw in Apache Cordova ( cordova-plugin-camera ). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS NVD)3.3Low
Exploit odds (30 days)0.7%top 45.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
We have resolved a security issue in the camera plugin that could have affected certain Cordova (Android) applications. An attacker who could install (or lead the victim to install) a specially crafted (or malicious) Android application would be able to access pictures taken with the app externally.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Apache Cordova ( cordova-plugin-camera ) | cordova-plugin-camera@4.1.0 and below |
References
- https://cordova.apache.org/news/2020/09/18/camera-plugin-release.html x_refsource_MISC
- JVN#59779918 third-party-advisory, x_refsource_JVN