CVE-2017-3160: Channel Accessible by Non-Endpoint (Man-in-the-Middle)

February 1, 2018 (updated April 15, 2020)

After the Android platform is added to Cordova the first time, or after a project is created using the build scripts, the scripts will fetch Gradle on the first build. However, since the default URI is not using https, it is vulnerable to a MiTM and the Gradle executable is not safe.

References

www.securityfocus.com/bid/95838
cordova.apache.org/announcements/2017/01/27/android-612.html
nvd.nist.gov/vuln/detail/CVE-2017-3160

Code Behaviors & Features

Detect and mitigate CVE-2017-3160 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →