Is CVE-2019-0219 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2019-0219 being exploited in the wild.

How severe is CVE-2019-0219?

Critical severity, with a CVSS score of 9.8, published 4 September 2020.

Which products and versions are affected?

Apache Software Foundation InAppBrowser plugin < 3.1.0; cordova-plugin-inappbrowser (npm) < 3.1.0, SEMVER:introduced=0,fixed=3.1.0.

Is there a fix for CVE-2019-0219?

Yes. cordova-plugin-inappbrowser (npm): upgrade to 3.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2019-0219 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2019-0219?

Check whether you run Apache Software Foundation InAppBrowser plugin or cordova-plugin-inappbrowser (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-0219: Apache cordova-plugin-inappbrowser privilege escalation on Android

Q: Is there a fix for CVE-2019-0219?

Yes. cordova-plugin-inappbrowser (npm): upgrade to 3.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2019-0219 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2019-0219?

Check whether you run Apache Software Foundation InAppBrowser plugin or cordova-plugin-inappbrowser (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-0219 · Severity: critical · CVSS 9.8 · Published 2020-09-04

The cordova-plugin-inappbrowser is a tool used in mobile applications to display web pages within the app. A security flaw in older versions allows a malicious website opened inside this browser window to take control of the main application. This could lead to the theft of sensitive user data or unauthorized actions being performed by the app on the user's behalf.

Vendors: Apache Software Foundation, npm.

Quick answers

Is CVE-2019-0219 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2019-0219 being exploited in the wild.
How severe is CVE-2019-0219?: Critical severity, with a CVSS score of 9.8, published 4 September 2020.
Which products and versions are affected?: Apache Software Foundation InAppBrowser plugin < 3.1.0; cordova-plugin-inappbrowser (npm) < 3.1.0, SEMVER:introduced=0,fixed=3.1.0.
Is there a fix for CVE-2019-0219?: Yes. cordova-plugin-inappbrowser (npm): upgrade to 3.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2019-0219 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2019-0219?: Check whether you run Apache Software Foundation InAppBrowser plugin or cordova-plugin-inappbrowser (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

cordova-plugin-inappbrowser (npm): upgrade to 3.1.0 or later
```
npm install cordova-plugin-inappbrowser@3.1.0
```

Technical details

A privilege escalation vulnerability exists in cordova-plugin-inappbrowser versions prior to 3.1.0 on Android. The flaw is rooted in improper neutralization of input, specifically allowing a website running within the InAppBrowser webview to trigger arbitrary JavaScript execution in the main application's webview. This is achieved by using a specially crafted 'gap-iab:' URI. An attacker who can convince a user to visit a malicious site within the affected InAppBrowser component can gain full control over the host application's web environment. The issue is resolved in version 3.1.0.

Affected products

Apache cordova-plugin-inappbrowser < 3.1.0

Identifiers

CVE-2019-0219
GHSA-c6pw-q7f2-97hv

Timeline

2019-11-28: disclosed: Public disclosure on oss-security list
2020-01-14: advisory: NVD publication date
2020-09-04: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.