PT-2022-16451 · Unknown · Whale Browser

Young Min Kim · Published 2022-03-17 · Updated 2022-03-23 · CVE-2022-24072

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Whale browser versions prior to 3.12.129.18

Description The issue concerns the devtools API in the Whale browser, which allowed extension developers to inject arbitrary JavaScript into the extension store web page via devtools.inspectedWindow. This led to extensions downloading and uploading when users opened the developer tool.

Recommendations For Whale browser versions prior to 3.12.129.18, update to version 3.12.129.18 or later to resolve the issue. As a temporary workaround, consider disabling the use of the devtools API until a patch is available.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2022-24072

Affected Products

Whale Browser

References · 4

• https://cve.naver.com/detail/cve-2022-24072 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24072 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24072 · Vendor Advisory
• https://t.me/cibsecurity/39116 · Telegram Post