| Package | Affected versions | Patched versions |
|---|---|---|
| cordova inappbrowser | ≤ 3.0.0 | |
| instantis enterprisetrack | = 17.1= 17.2= 17.3 | |
| retail xstore point of service | = 16.0.6= 17.0.4= 18.0.3= 19.0.2 | |
| cordova-plugin-inappbrowser | < 3.1.0 | 3.1.0 |
Versions of cordova-plugin-inappbrowser prior to 3.1.0 are vulnerable to Privilege Escalation. A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a specially crafted gap-iab: URI. This affects Cordova Android applications using the package.
Upgrade to version 3.1.0 or later.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free