« Volver al listado

CVE-2023-51219

Estado: AplazadaCrítica (9.6)—

A deep link validation issue in KakaoTalk 10.4.3 allowed a remote adversary to direct users to run any attacker-controlled JavaScript within a WebView. The impact was further escalated by triggering another WebView that leaked its access token in a HTTP request header. Ultimately, this access token could be used to take over another user's account and read her/his chat messages.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Kakaocorp — KakaotalkAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-51219",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-51219",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-02-19T21:01:26.565218Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.6,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-06-03T20:15:08.810",
  "references": [
    {
      "url": "https://news.ycombinator.com/item?id=40776880",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://stulle123.github.io/posts/kakaotalk-account-takeover/",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://news.ycombinator.com/item?id=40776880",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://stulle123.github.io/posts/kakaotalk-account-takeover/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A deep link validation issue in KakaoTalk 10.4.3 allowed a remote adversary to direct users to run any attacker-controlled JavaScript within a WebView. The impact was further escalated by triggering another WebView that leaked its access token in a HTTP request header. Ultimately, this access token could be used to take over another user's account and read her/his chat messages."
    },
    {
      "lang": "es",
      "value": "Un problema de validación de enlace profundo en KakaoTalk 10.4.3 permitió que un adversario remoto dirigiera a los usuarios a ejecutar cualquier JavaScript controlador de atacante dentro de un WebView. El impacto se intensificó aún más al activar otro WebView que filtró su token de acceso en un encabezado de solicitud HTTP. En última instancia, este token de acceso podría usarse para hacerse cargo de la cuenta de otro usuario y leer sus mensajes de chat."
    }
  ],
  "lastModified": "2026-06-17T06:40:36.650",
  "sourceIdentifier": "cve@mitre.org"
}