CVE-2022-24075 : Whale browser before 3.12.129.18 allowed extensions to replace JavaScript files of the HWP viewer website which could ac

Whale browser before 3.12.129.18 allowed extensions to replace JavaScript files of the HWP viewer website which could access to local HWP files. When the HWP files were opened, the replaced script could read the files.

Published 2022-03-17 06:15:07

Updated 2022-03-23 18:52:25

Source Naver Corporation

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2022-24075

EPSS FAQ

0.15%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 51 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-24075

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:P/I:N/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N	2.8	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2022-24075

CWE-552 Files or Directories Accessible to External Parties

The product makes files or directories accessible to unauthorized actors, even though they should not be.

Assigned by:

cve@navercorp.com (Secondary)
nvd@nist.gov (Primary)

Products affected by CVE-2022-24075

Navercorp » Whale
Versions before (<) 3.12.129.18
cpe:2.3:a:navercorp:whale:*:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2022-24075

Exploit prediction scoring system (EPSS) score for CVE-2022-24075

CVSS scores for CVE-2022-24075

CWE ids for CVE-2022-24075

References for CVE-2022-24075

Products affected by CVE-2022-24075