CVE-2021-44683

{"id": "CVE-2021-44683", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 2.8}]}, "published": "2022-03-25T22:15:08.033", "references": [{"url": "https://www.cybercitadel.com/remote-address-bar-spoofing-and-html-injection-disclosures/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-1021"}]}], "descriptions": [{"lang": "en", "value": "The DuckDuckGo browser 7.64.4 on iOS allows Address Bar Spoofing due to mishandling of the JavaScript window.open function (used to open a secondary browser window). This could be exploited by tricking users into supplying sensitive information such as credentials, because the address bar would display a legitimate URL, but content would be hosted on the attacker's web site."}, {"lang": "es", "value": "El navegador DuckDuckGo versi\u00f3n 7.64.4 en iOS, permite una Suplantaci\u00f3n de la Barra de Direcciones debido al manejo inapropiado de la funci\u00f3n JavaScript window.open (usada para abrir una ventana secundaria del navegador). Esto podr\u00eda ser explotado al enga\u00f1ar a usuarios para que proporcionen informaci\u00f3n confidencial como credenciales, ya que la barra de direcciones mostrar\u00eda una URL leg\u00edtima, pero el contenido estar\u00eda alojado en el sitio web del atacante"}], "lastModified": "2022-03-31T13:02:56.103", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:duckduckgo:duckduckgo:*:*:*:*:*:iphone_os:*:*", "vulnerable": true, "matchCriteriaId": "E74D8049-CED0-410D-A87B-E69343027D9A", "versionEndExcluding": "7.64.18"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}