CVE-2022-30334 Information disclosure in n/a
Brave browser leaks .onion URLs in headers when using Private Windows with Tor, exposing sensitive browsing data to external sites.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-30334?
CVE-2022-30334 is a medium-severity vulnerability in n/a, published on 7 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Brave before 1.34, when a Private Window with Tor Connectivity is used, leaks .onion URLs in Referer and Origin headers. NOTE: although this was fixed by Brave, the Brave documentation still advises "Note that Private Windows with Tor Connectivity in Brave are just regular private windows that use Tor as a proxy. Brave does NOT implement most of the privacy protections from Tor Browser."
Weakness: CWE-200
Which versions are affected by CVE-2022-30334?
It affects 1 product.
Products include Brave Brave.
How do I fix CVE-2022-30334?
No fix has been published for CVE-2022-30334 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-30334 being exploited?
There is no known exploitation of CVE-2022-30334 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-7v5m-29mq-3xq4.