CVE-2022-24072

The devtools API in Whale browser before 3.12.129.18 allowed extension developers to inject arbitrary JavaScript into the extension store web page via devtools.inspectedWindow, leading to extensions downloading and uploading when users open the developer tool.

CVSS v3 6.1 MEDIUM
CVSS v2.0 4.3 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://cve.naver.com/detail/cve-2022-24072	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:navercorp:whale:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-03-17 06:15

Updated : 2022-03-23 18:22

NVD link : CVE-2022-24072

Mitre link : CVE-2022-24072

CVE.ORG link : CVE-2022-24072

JSON object : View

Products Affected

navercorp

whale

CWE

NVD-CWE-noinfo CWE-269

Improper Privilege Management

{"id": "CVE-2022-24072", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2022-03-17T06:15:06.627", "references": [{"url": "https://cve.naver.com/detail/cve-2022-24072", "tags": ["Vendor Advisory"], "source": "cve@navercorp.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "cve@navercorp.com", "description": [{"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "The devtools API in Whale browser before 3.12.129.18 allowed extension developers to inject arbitrary JavaScript into the extension store web page via devtools.inspectedWindow, leading to extensions downloading and uploading when users open the developer tool."}, {"lang": "es", "value": "La API devtools en Whale browser versiones anteriores a 3.12.129.18, permit\u00eda a desarrolladores de extensiones inyectar JavaScript arbitrario en la p\u00e1gina web de la tienda de extensiones por medio de devtools.inspectedWindow, conllevando a una descarga y carga de extensiones cuando los usuarios abr\u00edan la herramienta para desarrolladores"}], "lastModified": "2022-03-23T18:22:10.737", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:navercorp:whale:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "47138F1B-655D-4459-905C-7BFA3A326DC5", "versionEndExcluding": "3.12.129.18"}], "operator": "OR"}]}], "sourceIdentifier": "cve@navercorp.com"}