Strix
26.1K

CVE-2023-22798

MEDIUMCVSS 6.1/10EPSS 0.47%

Last modified

CVE-2023-22798 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. Prior to commit 51867e0d15a6d7f80d5b714fd0e9976b9c160bb0, https://github.com/brave/adblock-lists removed redirect interceptors on some websites like Facebook in which the redirect interceptor may have been there for security purposes. This could potentially cause open redirects on these websites. EPSS estimates a 0.47% chance of exploitation in the next 30 days.

Description

Prior to commit 51867e0d15a6d7f80d5b714fd0e9976b9c160bb0, https://github.com/brave/adblock-lists removed redirect interceptors on some websites like Facebook in which the redirect interceptor may have been there for security purposes. This could potentially cause open redirects on these websites. Brave's redirect interceptor removal feature is known as "debouncing" and is intended to remove unnecessary redirects that track users across the web.

Metrics

CVSS 3.1
6.1/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Probability
0.47%

37.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
BraveAdblock-Lists< 2022-05-25

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2023-22798?
Prior to commit 51867e0d15a6d7f80d5b714fd0e9976b9c160bb0, https://github.com/brave/adblock-lists removed redirect interceptors on some websites like Facebook in which the redirect interceptor may have been there for security purposes. This could potentially cause open redirects on these websites. Brave's redirect interceptor removal feature is known as "debouncing" and is intended to remove unnecessary redirects that track users across the web.
How severe is CVE-2023-22798?
CVE-2023-22798 has a CVSS score of 6.1/10 (MEDIUM severity). The EPSS model estimates a 0.47% probability of exploitation in the next 30 days.
How do I fix CVE-2023-22798?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2023-22798?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST