{"id":"CVE-2021-22916","published":"2021-07-12T10:22:31Z","modified":"2024-08-03T18:58:25Z","title":"In Brave Desktop between versions 1.17 and 1.26.60, when adblocking is enabled and a proxy browser extension is…","vendor":null,"product":null,"tier":"tail","description":{"text":"In Brave Desktop between versions 1.17 and 1.26.60, when adblocking is enabled and a proxy browser extension is installed, the CNAME adblocking feature issues DNS requests that used the system DNS settings instead of the extension's proxy settings, resulting in possible information disclosure.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.02993,"percentile":0.87285,"provenance":"source"},"cwes":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"references":[{"url":"https://hackerone.com/reports/1203842","tags":["x_refsource_MISC"]}],"priority":{"score":17.5,"factors":[{"name":"EPSS percentile","points":17.46}]},"affectedVersions":[{"vendor":"n/a","product":"https://github.com/brave/brave-core","versions":["Fixed in 1.26.60"]}],"euvd":{"id":"EUVD-2021-10045","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-brave-browser-cve-2021-21323","children":[{"from":"CVE-2021-22916","to":"CVE-2021-45884","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this issue exists because of an incomplete fix for CVE-2021-21323 and CVE-2021-22916.","from":"CVE.org","in":"CVE-2021-45884"}]}]}}