PT-2017-18348 · Brave · Brave

Ajdumanhug · Published 2017-05-03 · Updated 2019-10-03 · CVE-2017-8458

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Brave version 0.12.4

Description The issue is related to URI Obfuscation, where a string such as https://[e-mail]/ is displayed without clear UI indication that it is not a resource on the safe.example.com web site.

Recommendations For version 0.12.4, consider updating to a newer version that addresses this issue, as no specific fix is provided for this version.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2017-8458

Affected Products

Brave

References · 4

• 🔥 https://hackerone.com/reports/175529 · Exploit
• https://github.com/brave/browser-laptop/issues/4748 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2017-8458 · Security Note
• https://osv.dev/vulnerability/CVE-2017-8458 · Vendor Advisory