CVE-2018-1000815

Published: Dec 20, 2018Modified: Nov 21, 2024

4.3

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

Brave Software Inc. Brave version version 0.22.810 to 0.24.0 contains a Other/Unknown vulnerability in function ContentSettingsObserver::AllowScript() in content_settings_observer.cc that can result in Websites can run inline JavaScript even if script is blocked, making attackers easier to track users. This attack appear to be exploitable via the victim must visit a specially crafted website. This vulnerability appears to have been fixed in 0.25.2.

Affected (1)

Products: Brave: Brave

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Brave Brave	From 0.22.810 to 0.24.0

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (6)

https://github.com/brave/browser-laptop/issues/15232

Source: cve@mitre.org

PatchThird Party Advisory

https://github.com/brave/muon/commit/c18663aa171c6cdf03da3e8c70df8663645b97c4

Source: cve@mitre.org

Patch

https://github.com/brave/muon/pull/651

Source: cve@mitre.org

Patch

https://github.com/brave/browser-laptop/issues/15232

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://github.com/brave/muon/commit/c18663aa171c6cdf03da3e8c70df8663645b97c4

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/brave/muon/pull/651

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

Timeline

No history available yet.