CVE-2021-45884 Information disclosure in n/a

High 7.5 Published 27 Dec 2021 Updated 4 Aug 2024

Attackers can leak DNS requests outside the proxy when specific adblocking and proxy settings are enabled, exposing user browsing activity.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-45884?

CVE-2021-45884 is a high-severity vulnerability in n/a, published on 27 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In Brave Desktop 1.17 through 1.33 before 1.33.106, when CNAME-based adblocking and a proxying extension with a SOCKS fallback are enabled, additional DNS requests are issued outside of the proxying extension using the system's DNS settings, resulting in information disclosure. NOTE: this issue exists because of an incomplete fix for CVE-2021-21323 and CVE-2021-22916.

Weakness: CWE-200

Which versions are affected by CVE-2021-45884?

It affects 1 product.

Products include Brave Brave.

How do I fix CVE-2021-45884?

No fix has been published for CVE-2021-45884 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-45884 being exploited?

There is no known exploitation of CVE-2021-45884 in the wild and no public exploit code.

Sources

Also known as GHSA-7q5w-r799-frgq.