PT-2021-15281 · Brave+1 · Brave Browser+1

Sickcodes

·

Published

2021-08-16

·

Updated

2025-07-02

·

CVE-2021-22929

CVSS v3.1

6.1

Medium

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Name of the Vulnerable Software and Affected Versions Brave Browser Desktop versions prior to 1.28.62
Description An information disclosure issue exists where logged warning messages include timestamps of connections to V2 onion domains in tor.log. This issue affects versions prior to 1.28.62, where the server connection time for all v2 tor domains is permanently logged to ~/.config/BraveSoftware/Brave-Browser/tor/data/tor.log.
Recommendations For versions prior to 1.28.62, update to version 1.28.62 or later to resolve the issue. As a temporary workaround, consider restricting access to the tor.log file to minimize the risk of information disclosure.

Exploit

Fix

Insertion into Log File

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-532CWE-312

Related Identifiers

CVE-2021-22929
OPENSUSE-SU-2021:1513-1
OPENSUSE-SU-2021:1524-1
OPENSUSE-SU-2021_1513-1
OPENSUSE-SU-2024:11639-1

Affected Products

Brave Browser
Suse