OpenCVE

Brave Browser before 1.43.88 allowed a remote attacker to cause a denial of service in private and guest windows via a crafted HTML file that mentions an ipfs:// or ipns:// URL. This is caused by an incomplete fix for CVE-2022-47932 and CVE-2022-47934.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Brave	Brave

Configuration 1 [-]

cpe:2.3:a:brave:brave:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/brave/brave-browser/issues/24211
https://github.com/brave/brave-browser/issues/25106
https://github.com/brave/brave-core/commit/82d8e39043e691e0492519126437275511ee87e8
https://github.com/brave/brave-core/pull/14313
https://hackerone.com/reports/1646204

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2022-12-24T00:00:00

Updated: 2024-08-03T15:02:36.648Z

Reserved: 2022-12-23T00:00:00

Link: CVE-2022-47934

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-12-24T22:15:09.420

Modified: 2024-11-21T07:32:34.190

Link: CVE-2022-47934

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:brave:brave:*:*:*:*:*:*:*:*", "matchCriteriaId": "BA16050C-86A5-4AA7-AE82-8815BC92E596", "versionEndExcluding": "1.43.88", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Brave Browser before 1.43.88 allowed a remote attacker to cause a denial of service in private and guest windows via a crafted HTML file that mentions an ipfs:// or ipns:// URL. This is caused by an incomplete fix for CVE-2022-47932 and CVE-2022-47934."}, {"lang": "es", "value": "Brave Browser anterior a 1.43.88 permit\u00eda a un atacante remoto provocar una Denegaci\u00f3n de Servicio (DoS) en ventanas privadas e invitadas a trav\u00e9s de un archivo HTML manipulado que menciona una URL ipfs:// o ipns://. Esto se debe a una soluci\u00f3n incompleta para CVE-2022-47932 y CVE-2022-47934."}], "id": "CVE-2022-47934", "lastModified": "2024-11-21T07:32:34.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-12-24T22:15:09.420", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://github.com/brave/brave-browser/issues/24211"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking", "Release Notes", "Third Party Advisory"], "url": "https://github.com/brave/brave-browser/issues/25106"}, {"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/brave/brave-core/commit/82d8e39043e691e0492519126437275511ee87e8"}, {"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/brave/brave-core/pull/14313"}, {"source": "cve@mitre.org", "tags": ["Permissions Required", "Third Party Advisory"], "url": "https://hackerone.com/reports/1646204"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://github.com/brave/brave-browser/issues/24211"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Release Notes", "Third Party Advisory"], "url": "https://github.com/brave/brave-browser/issues/25106"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/brave/brave-core/commit/82d8e39043e691e0492519126437275511ee87e8"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/brave/brave-core/pull/14313"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Permissions Required", "Third Party Advisory"], "url": "https://hackerone.com/reports/1646204"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}