After the Android platform is added to Cordova the first time, or after a project is created using the build scripts, the scripts will fetch Gradle on the first build. However, since the default URI is not using https, it is vulnerable to a MiTM and the Gradle executable is not safe. The severity of this issue is high due to the fact that the build scripts immediately start a build after Gradle has been fetched. Developers who are concerned about this issue should install version 6.1.2 or higher of Cordova-Android. If developers are unable to install the latest version, this vulnerability can easily be mitigated by setting the CORDOVA_ANDROID_GRADLE_DISTRIBUTION_URL environment variable to https://services.gradle.org/distributions/gradle-2.14.1-all.zip
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published: 2018-02-01T21:00:00Z

Updated: 2024-09-16T19:56:14.676Z

Reserved: 2016-12-05T00:00:00

Link: CVE-2017-3160

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2018-02-01T21:29:00.197

Modified: 2024-11-21T03:24:57.227

Link: CVE-2017-3160

cve-icon Redhat

No data.