{"containers": {"cna": {"affected": [{"product": "Whale Browser", "vendor": "NAVER Corporation", "versions": [{"lessThan": "1.3.48.4", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "YongShao (Zhiyong Feng) of Mobike Security Team"}], "datePublic": "2018-08-01T00:00:00", "descriptions": [{"lang": "en", "value": "Whale Browser before 1.3.48.4 displays no URL information but only a title of a web page on the browser's address bar when visiting a non-http page, which allows an attacker to display a malicious web page with a fake domain name."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2018-08-02T12:57:01", "orgId": "f9629fae-ca2e-4fbf-9785-3ed86476aef6", "shortName": "naver"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://cve.naver.com/detail/cve-2018-12448.html"}], "source": {"discovery": "EXTERNAL"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@navercorp.com", "ID": "CVE-2018-12448", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Whale Browser", "version": {"version_data": [{"affected": "<", "version_affected": "<", "version_value": "1.3.48.4"}]}}]}, "vendor_name": "NAVER Corporation"}]}}, "credit": [{"lang": "eng", "value": "YongShao (Zhiyong Feng) of Mobike Security Team"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Whale Browser before 1.3.48.4 displays no URL information but only a title of a web page on the browser's address bar when visiting a non-http page, which allows an attacker to display a malicious web page with a fake domain name."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-20"}]}]}, "references": {"reference_data": [{"name": "https://cve.naver.com/detail/cve-2018-12448.html", "refsource": "MISC", "url": "https://cve.naver.com/detail/cve-2018-12448.html"}]}, "source": {"discovery": "EXTERNAL"}}}}, "cveMetadata": {"assignerOrgId": "f9629fae-ca2e-4fbf-9785-3ed86476aef6", "assignerShortName": "naver", "cveId": "CVE-2018-12448", "datePublished": "2018-08-02T13:00:00", "dateReserved": "2018-06-15T00:00:00", "dateUpdated": "2018-08-02T12:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:navercorp:whale:*:*:*:*:*:*:*:*", "matchCriteriaId": "34165235-7B35-456E-8762-E3E89E49A19C", "versionEndExcluding": "1.3.48.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Whale Browser before 1.3.48.4 displays no URL information but only a title of a web page on the browser's address bar when visiting a non-http page, which allows an attacker to display a malicious web page with a fake domain name."}, {"lang": "es", "value": "Whale Browser en versiones anteriores a la 1.3.48.4 no muestra informaci\u00f3n de la URL; solo un t\u00edtulo de p\u00e1gina web en la barra de direcciones del navegador al visitar una p\u00e1gina que no es HTTP. Esto permite que un atacante muestre una p\u00e1gina web maliciosa con un nombre de dominio falso."}], "id": "CVE-2018-12448", "lastModified": "2019-10-09T23:33:57.590", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-08-02T13:29:00.267", "references": [{"source": "cve@navercorp.com", "tags": ["Vendor Advisory"], "url": "https://cve.naver.com/detail/cve-2018-12448.html"}], "sourceIdentifier": "cve@navercorp.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-20"}], "source": "cve@navercorp.com", "type": "Secondary"}]}

{}