Lucene search

HackeroneCVE-2024-37406

HistorySep 18, 2024 - 10:15 p.m.

CVE-2024-37406

2024-09-1822:15:04

CWE-20

hackerone

web.nvd.nist.gov

brave android

vulnerability

elided domains

domain confusion

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

Confidence

Low

EPSS

Percentile

9.6%

JSON

In Brave Android prior to v1.67.116, domains in the Brave Shields popup are elided from the right instead of the left, which may lead to domain confusion.

Affected configurations

Vulners

Vulnrichment

Node

bravebrowserRange<1.67.116android

VendorProductVersionCPE
bravebrowser*cpe:2.3:a:brave:browser:*:*:*:*:*:android:*:*

Vendor	Product	Version	CPE
brave	browser	*	cpe:2.3:a:brave:browser::::::android::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "vendor": "Brave",
    "product": "Android Browser",
    "versions": [
      {
        "version": "1.67.116",
        "status": "affected",
        "lessThan": "1.67.116",
        "versionType": "semver"
      }
    ]
  }
]

References

hackerone.com/reports/2501378

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

Confidence

Low

EPSS

Percentile

9.6%

JSON

Related for CVE-2024-37406