securitywebviewappceleratortitanium-alloy

how to avoid remote code execution in webview appcelerator?

My app not pass in pentest because my webview is no security. They return this info "Remote Code Execution em WebView RCE - CVE-2013-4710".

I need information for resolve this problem and distribute my app.

Thanks for help.

Solution

  • CVE-2013-4710 is a vulnerability in WebView, you can find the issue here: https://www.cvedetails.com/cve/CVE-2013-4710/ it looks like it affects really old versions of Android (3.x - 4.x) and the current version is 10.x. From what I can gather, the fix is to not use an old version of Android. If your app is using a new version of Android, then this might be a false positive in the tool used to scan your app. What tool said you had the issue?