CVE-2022-24074

Whale Bridge, a default extension in Whale browser before 3.12.129.18, allowed to receive any SendMessage request from the content script itself that could lead to controlling Whale Bridge if the rendering process compromises.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://cve.naver.com/detail/cve-2022-24074	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:navercorp:whale:*:*:*:*:*:*:*:*

History

30 Jun 2023, 18:50

Type	Values Removed	Values Added
CWE	~~CWE-732~~	CWE-668

23 Mar 2022, 18:50

Type	Values Removed	Values Added
CPE		cpe:2.3:a:navercorp:whale::::::::
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : 7.5 v3 : 9.8
CWE		CWE-732
First Time		Navercorp whale Navercorp
References	~~(CONFIRM) https://cve.naver.com/detail/cve-2022-24074 -~~	(CONFIRM) https://cve.naver.com/detail/cve-2022-24074 - Vendor Advisory

17 Mar 2022, 06:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-03-17 06:15

Updated : 2023-12-10 14:22

NVD link : CVE-2022-24074

Mitre link : CVE-2022-24074

CVE.ORG link : CVE-2022-24074

JSON object : View

Products Affected

navercorp

whale

CWE

CWE-668

Exposure of Resource to Wrong Sphere

{"id": "CVE-2022-24074", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2022-03-17T06:15:06.887", "references": [{"url": "https://cve.naver.com/detail/cve-2022-24074", "tags": ["Vendor Advisory"], "source": "cve@navercorp.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-668"}]}, {"type": "Secondary", "source": "cve@navercorp.com", "description": [{"lang": "en", "value": "CWE-668"}]}], "descriptions": [{"lang": "en", "value": "Whale Bridge, a default extension in Whale browser before 3.12.129.18, allowed to receive any SendMessage request from the content script itself that could lead to controlling Whale Bridge if the rendering process compromises."}, {"lang": "es", "value": "Whale Bridge, una extensi\u00f3n por defecto en el navegador Whale versiones anteriores a 3.12.129.18, permit\u00eda recibir cualquier petici\u00f3n SendMessage desde el propio script de contenido que pod\u00eda conllevar a el control de Whale Bridge si el proceso de renderizado es comprometido"}], "lastModified": "2023-06-30T18:50:39.697", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:navercorp:whale:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "47138F1B-655D-4459-905C-7BFA3A326DC5", "versionEndExcluding": "3.12.129.18"}], "operator": "OR"}]}], "sourceIdentifier": "cve@navercorp.com"}