What is CVE-2021-22917?

CVE-2021-22917 is a medium-severity vulnerability in Brave Browser, classified under Information Disclosure. CVSS score: 6.5/10. Published 2021-07-12.

How severe is CVE-2021-22917?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Information disclosure in Brave Browser

CVE-2021-22917

Brave Browser Desktop between versions 1.17 and 1.20 is vulnerable to information disclosure by way of DNS requests in Tor windows not flowing through Tor if adblocking was enabled.

Vulnerability class: Information Disclosure

EPSS: 0.012 (65.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N.

Affected products

Brave Browser
N/a Https://github.com/brave/brave-core — versions Fixed in 1.20

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

support@hackerone.com (Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2021-22917?: CVE-2021-22917 is a medium-severity vulnerability in Brave Browser, classified under Information Disclosure. CVSS score: 6.5/10. Published 2021-07-12.
How severe is CVE-2021-22917?: Medium severity. CVSS v3 base score is 6.5 out of 10.