CVE-2014-1884
Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier on Windows Phone 7 and 8 do...
Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier on Windows Phone 7 and 8 do not properly restrict navigation events, which allows remote attackers to bypass intended device-resource restrictions via content that is accessed (1) in an IFRAME element or (2) with the XMLHttpRequest method by a crafted application.
Exploit likelihood
What each source reports
NVD Score used
Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier on Windows Phone 7 and 8 do not properly restrict navigation events, which allows remote attackers to bypass intended device-resource restrictions via content that is accessed (1) in an IFRAME element or (2) with the XMLHttpRequest method by a crafted application.
- Record
CVE-2014-1884- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier on Windows Phone 7 and 8 do not properly restrict navigation events, which allows remote attackers to bypass intended device-resource restrictions via content that is accessed (1) in an IFRAME element or (2) with the XMLHttpRequest method by a crafted application.
- Record
CVE-2014-1884- Updated
- 2026-11-02
EUVDEUVD-2014-1946 No score
Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier on Windows Phone 7 and 8 do not properly restrict navigation events, which allows remote attackers to bypass intended device-resource restrictions via content that is accessed (1) in an IFRAME element or (2) with the XMLHttpRequest method by a crafted application.
- Record
EUVD-2014-1946- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9vrm-p52c-wm94 No score
Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier on Windows Phone 7 and 8 do...
Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier on Windows Phone 7 and 8 do not properly restrict navigation events, which allows remote attackers to bypass intended device-resource restrictions via content that is accessed (1) in an IFRAME element or (2) with the XMLHttpRequest method by a crafted application.
- Record
GHSA-9vrm-p52c-wm94- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-1884 is a high vulnerability (CVSS 7.5) in Adobe Phonegap, published March 3, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.20%, the 94th percentile. No source names a fixed version.
References
cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf
internetsociety.org/ndss2014/programme
seclists.org/bugtraq/2014/Jan/96
openwall.com/lists/oss-security/2014/02/07/9
packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt
nvd.nist.gov/vuln/detail/CVE-2014-1884
github.com/advisories/GHSA-9vrm-p52c-wm94