fkie_cve-2018-12448
Vulnerability from fkie_nvd
Published
2018-08-02 13:29
Modified
2024-11-21 03:45
Severity ?
Summary
Whale Browser before 1.3.48.4 displays no URL information but only a title of a web page on the browser's address bar when visiting a non-http page, which allows an attacker to display a malicious web page with a fake domain name.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@navercorp.com | https://cve.naver.com/detail/cve-2018-12448.html | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://cve.naver.com/detail/cve-2018-12448.html | Vendor Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:navercorp:whale:*:*:*:*:*:*:*:*",
"matchCriteriaId": "34165235-7B35-456E-8762-E3E89E49A19C",
"versionEndExcluding": "1.3.48.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Whale Browser before 1.3.48.4 displays no URL information but only a title of a web page on the browser\u0027s address bar when visiting a non-http page, which allows an attacker to display a malicious web page with a fake domain name."
},
{
"lang": "es",
"value": "Whale Browser en versiones anteriores a la 1.3.48.4 no muestra informaci\u00f3n de la URL; solo un t\u00edtulo de p\u00e1gina web en la barra de direcciones del navegador al visitar una p\u00e1gina que no es HTTP. Esto permite que un atacante muestre una p\u00e1gina web maliciosa con un nombre de dominio falso."
}
],
"id": "CVE-2018-12448",
"lastModified": "2024-11-21T03:45:14.387",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-08-02T13:29:00.267",
"references": [
{
"source": "cve@navercorp.com",
"tags": [
"Vendor Advisory"
],
"url": "https://cve.naver.com/detail/cve-2018-12448.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://cve.naver.com/detail/cve-2018-12448.html"
}
],
"sourceIdentifier": "cve@navercorp.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "cve@navercorp.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…