CVE-2021-21323

Katalog CVE

CVSS 5.3 · Medium EPSS 2,3%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada brave. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Brave is an open source web browser with a focus on privacy and security. In Brave versions 1.17.73-1.20.103, the CNAME adblocking feature added in Brave 1.17.73 accidentally initiated DNS requests that bypassed the Brave Tor proxy. Users with adblocking enabled would leak DNS requests from Tor windows to their DNS provider. (DNS requests that were not initiated by CNAME adblocking would go through Tor as expected.) This is fixed in Brave version 1.20.108

Rincian

Terbit di NVD

23 Februari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

2,3% peluang dieksploitasi; lebih tinggi dari 82,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/brave/brave-browser/issues/13527 patch · advisory pihak ketiga
• https://github.com/brave/brave-core/commit/12fe321eaad8acc1cbd1d70b4128f687777bcf15 patch · advisory pihak ketiga
• https://github.com/brave/brave-core/pull/7769 patch · advisory pihak ketiga
• https://github.com/brave/brave-browser/security/advisories/GHSA-mqjf-9x5g-2rv6 advisory pihak ketiga
• https://hackerone.com/reports/1077022 permissions required · advisory pihak ketiga