« Volver al listado

CVE-2018-12448

Estado: ModificadaMedia (5.3)—

Whale Browser before 1.3.48.4 displays no URL information but only a title of a web page on the browser's address bar when visiting a non-http page, which allows an attacker to display a malicious web page with a fake domain name.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Navercorp — Whale

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-12448",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@navercorp.com",
      "affectedData": [
        {
          "vendor": "NAVER Corporation",
          "product": "Whale Browser",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "1.3.48.4",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-08-02T13:29:00.267",
  "references": [
    {
      "url": "https://cve.naver.com/detail/cve-2018-12448.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@navercorp.com"
    },
    {
      "url": "https://cve.naver.com/detail/cve-2018-12448.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@navercorp.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Whale Browser before 1.3.48.4 displays no URL information but only a title of a web page on the browser's address bar when visiting a non-http page, which allows an attacker to display a malicious web page with a fake domain name."
    },
    {
      "lang": "es",
      "value": "Whale Browser en versiones anteriores a la 1.3.48.4 no muestra información de la URL; solo un título de página web en la barra de direcciones del navegador al visitar una página que no es HTTP. Esto permite que un atacante muestre una página web maliciosa con un nombre de dominio falso."
    }
  ],
  "lastModified": "2026-06-17T01:37:48.147",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:navercorp:whale:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "34165235-7B35-456E-8762-E3E89E49A19C",
              "versionEndExcluding": "1.3.48.4"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@navercorp.com"
}