PT-2018-9539 · Brave · Brave

Diracdeltas · Publicado 2018-12-20 · Atualizado 2019-02-06 · CVE-2018-1000815

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Brave version 0.22.810 through 0.24.0

Description The issue allows websites to run inline JavaScript even if script is blocked, making it easier for attackers to track users. This can be exploited when a victim visits a specially crafted website. The function ContentSettingsObserver::AllowScript() in content settings observer.cc is affected.

Recommendations For versions 0.22.810 through 0.24.0, update to version 0.25.2 to resolve the issue.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2018-1000815

Produtos afetados

Brave

Referências · 5

• https://github.com/brave/browser-laptop/issues/15232 · Correção
• https://github.com/brave/muon/commit/c18663aa171c6cdf03da3e8c70df8663645b97c4 · Correção
• https://github.com/brave/muon/pull/651 · Correção
• https://osv.dev/vulnerability/CVE-2018-1000815 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000815 · Nota de Segurança