Directory traversal vulnerability in cordova-plugin-ionic-webview versions prior to 2.2.0 (not including 2.0.0-beta.0, 2.0.0-beta.1,…

Description

Directory traversal vulnerability in cordova-plugin-ionic-webview versions prior to 2.2.0 (not including 2.0.0-beta.0, 2.0.0-beta.1, 2.0.0-beta.2, and 2.1.0-0) allows remote attackers to access arbitrary files via unspecified vectors.

Scores

EPSS (exploitation in 30 days)

3.3% · top 11% of all CVEs (4 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.6.

Weakness

• Directory Traversal
• CWE-22 (opens in a new tab)All about CWE-22 and its CVEs

Affected products

• npm, Inc. · cordova-plugin-ionic-webview

  • affected versions prior to 2.2.0 (not including 2.0.0-beta.0, 2.0.0-beta.1, 2.0.0-beta.2, and 2.1.0-0)

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• npmcordova-plugin-ionic-webviewGHSA-xwjh-cp99-cj8q (opens in a new tab)

References (4)

• JVN#69812763 (opens in a new tab)third-party-advisoryx_refsource_JVNx_transferred
• https://github.com/ionic-team/cordova-plugin-ionic-webview (opens in a new tab)x_refsource_MISCx_transferred
• https://www.npmjs.com/advisories/746 (opens in a new tab)x_refsource_MISCx_transferred
• JVN#60497148 (opens in a new tab)third-party-advisoryx_refsource_JVNx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-xwjh-cp99-cj8q (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2018-16202](https://trackcve.app/badge/CVE-2018-16202.svg)](https://trackcve.app/cve/CVE-2018-16202)

Record last updated 5 Aug 2024, 10:17 UTC.