PT-2022-28092 · Brave · Brave Browser

Cypt4 · Published 2022-12-24 · Updated 2022-12-30 · CVE-2022-47932

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Brave Browser versions prior to 1.43.34

Description The issue allows a remote attacker to cause a denial of service via a crafted HTML file that mentions an ipfs:// or ipns:// URL. This is due to an incomplete fix for a previous issue.

Recommendations For versions prior to 1.43.34, update to version 1.43.34 or later to resolve the issue. As a temporary workaround, consider avoiding the use of ipfs:// or ipns:// URLs in HTML files until the update is applied.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2022-47932

Affected Products

Brave Browser

References · 8

• 🔥 https://github.com/brave/brave-browser/issues/24093 · Exploit
• https://github.com/brave/brave-core/commit/e73309665508c17e48a67e302d3ab02a38d3ef50 · Patch
• https://github.com/brave/brave-core/pull/14211 · Patch
• https://osv.dev/vulnerability/CVE-2022-47932 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-47932 · Security Note
• https://t.me/cibsecurity/55286 · Telegram Post
• https://t.me/cibsecurity/55285 · Telegram Post
• https://hackerone.com/reports/1636430 · Note