CVE-2017-3160

CVE-2017-3160 describes a Man-in-the-Middle (MiTM) vulnerability in Apache Cordova-Android versions prior to 6.1.2. When Cordova-Android fetches Gradle for the first time, it uses an insecure HTTP URI, allowing an attacker to intercept and replace the Gradle executable, leading to potential compromise of the build process. This vulnerability is rated High (CVSS 7.4) due to its network-based attack vector, high impact on confidentiality and integrity, and low attack complexity. While there is no known active exploitation, public exploit code, or significant community discussion, developers should update to Cordova-Android 6.1.2 or higher, or mitigate by setting the CORDOVA_ANDROID_GRADLE_DISTRIBUTION_URL environment variable to a secure HTTPS link.