ByteOS Network

NVD Vulnerability Details :

CVE-2018-1000815

Analyzed

Source-cve@mitre.org

Published At-20 Dec, 2018 | 15:29

Updated At-06 Feb, 2019 | 14:36

Brave Software Inc. Brave version version 0.22.810 to 0.24.0 contains a Other/Unknown vulnerability in function ContentSettingsObserver::AllowScript() in content_settings_observer.cc that can result in Websites can run inline JavaScript even if script is blocked, making attackers easier to track users. This attack appear to be exploitable via the victim must visit a specially crafted website. This vulnerability appears to have been fixed in 0.25.2.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	4.3	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Primary	2.0	4.3	MEDIUM	AV:N/AC:M/Au:N/C:P/I:N/A:N

CPE Matches

brave>>brave>>Versions from 0.22.810(inclusive) to 0.24.0(inclusive)

cpe:2.3:a:brave:brave:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-20	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
https://github.com/brave/browser-laptop/issues/15232	cve@mitre.org	Patch Third Party Advisory
https://github.com/brave/muon/commit/c18663aa171c6cdf03da3e8c70df8663645b97c4	cve@mitre.org	Patch
https://github.com/brave/muon/pull/651	cve@mitre.org	Patch

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History