PT-2020-3991 · Naver · Naver Whale

Min Jang · Published 2020-05-19 · Updated 2020-05-21 · CVE-2020-9753

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Naver Whale versions prior to 1.2.0.5

Description: The issue is related to an installer vulnerability in the Naver Whale web browser, which is connected to incorrect cryptographic signature verification. This could allow an attacker to gain unauthorized access to protected information or impact data integrity.

Recommendations: For versions prior to 1.2.0.5, update to version 1.2.0.5 or later to resolve the issue. As a temporary workaround, consider disabling the installation of Flash components until a patch is available. Restrict access to sensitive information to minimize the risk of exploitation.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

BDU:2020-04385

CVE-2020-9753

Affected Products

Naver Whale

References · 5

• https://bdu.fstec.ru/vul/2020-04385 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-9753 · Security Note
• https://cve.naver.com/detail/cve-2020-9753 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-9753 · Vendor Advisory
• https://t.me/cvenotify/3925 · Telegram Post