Vulnerability · Published Feb 9, 2023 · Assigned by hackerone

CVE-2023-22798

Medium 6.1

In plain English

A medium-severity open redirect in https://github.com/brave/adblock-lists. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.5%top 58.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Prior to commit 51867e0d15a6d7f80d5b714fd0e9976b9c160bb0, https://github.com/brave/adblock-lists removed redirect interceptors on some websites like Facebook in which the redirect interceptor may have been there for security purposes. This could potentially cause open redirects on these websites. Brave's redirect interceptor removal feature is known as "debouncing" and is intended to remove unnecessary redirects that track users across the web.

Affected products (as reported)

Vendor	Product	Versions
n/a	https://github.com/brave/adblock-lists	51867e0d15a6d7f80d5b714fd0e9976b9c160bb0

Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

https://hackerone.com/reports/1579374