Sensitive information in log files in Apache Cordova Android
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-532.
Summary
Product: Apache Cordova Android 5.2.2 and earlier. The application calls methods of the Log class. Messages passed to these methods (Log.v(), Log.d(), Log.i(), Log.w(), and Log.e()) are stored in a series of circular buffers on the device. By default, a maximum of four 16 KB rotated logs are kept in addition to the current log. The logged data can be read using Logcat on the device. When using platforms prior to Android 4.1 (Jelly Bean), the log data is not sandboxed per application; any application installed on the device has the capability to read data logged by other applications.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Cordova Android | up to 5.2.2 | — | No fix listed | CNA |
| — | cordova-android (npm) | before 6.0.0 | 6.0.0 | Patch available | GHSA-gwpf-62xp-vrg6 |
- Apache Cordova Android VendorApache Affected up to 5.2.2 Fixed in — No fix listed CNA
- cordova-android (npm) Vendor— Affected before 6.0.0 Fixed in 6.0.0 Patch available GHSA-gwpf-62xp-vrg6
Remediation
- Fix · GHSA-gwpf-62xp-vrg6 cordova-android (npm) Fixed in 6.0.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2016-6799
- 2026-10-03 Alias added: GHSA-gwpf-62xp-vrg6
References
Other 6
- [dev] 20170509 CVE-2016-6799: Internal system information leak
- https://github.com/apache/cordova-android/commit/4a0a7bc424fae14c9689f4a8a2dc250ae3a47f82
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6799
- https://github.com/apache/cordova-android
- https://lists.apache.org/thread.html/1f3e7b0319d64b455f73616f572acee36fbca31f87f5b2e509c45b69@%3Cdev.cordova.apache.org%3E
- https://www.npmjs.com/advisories/964
More Apache Cordova vulnerabilities
- TI-2021-04415 Command injection in sebhildebrandt systeminformation KEVCVSS 3.1HIGH 7.8
- TI-2014-00068 The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin… CVSS 3.0CRITICAL 9.8
- TI-2014-01466 Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote… CVSS 2.0HIGH 7.5
- TI-2014-01465 Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote… CVSS 2.0HIGH 7.5
- TI-2014-01468 Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier on Windows Phone 7… CVSS 2.0HIGH 7.5
- TI-2012-05355 Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier do not anchor the… CVSS 2.0HIGH 7.5
Sources
- CVE-2016-6799 · CVE Program
- CVE-2016-6799 · NVD
- FIRST EPSS
- GHSA-gwpf-62xp-vrg6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences