PT-2021-15274 · Brave · Brave Browser

Newfunction · Published 2021-07-12 · Updated 2022-08-30 · CVE-2021-22917

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Brave Browser Desktop versions 1.17 through 1.20

Description The issue concerns information disclosure through DNS requests in Tor windows that do not flow through Tor when adblocking is enabled.

Recommendations For versions 1.17 through 1.20, consider disabling adblocking in Tor windows as a temporary workaround until a patch is available. Restrict the use of Tor windows with adblocking enabled to minimize the risk of information disclosure.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2021-22917

Affected Products

Brave Browser

References · 4

• https://osv.dev/vulnerability/CVE-2021-22917 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22917 · Security Note
• https://hackerone.com/reports/1077022 · Note
• https://t.me/cibsecurity/26054 · Telegram Post