« Volver al listado

CVE-2025-47241

Estado: AplazadaMedia (4)—

In browser-use (aka Browser Use) before 0.1.45, URL parsing of allowed_domains is mishandled because userinfo can be placed in the authority component.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Browser-use — Browser USEAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-47241",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-47241",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-05-05T15:42:53.386906Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@mitre.org",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "browser-use",
          "product": "browser-use",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "0.1.45",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-05-03T21:15:48.023",
  "references": [
    {
      "url": "https://github.com/browser-use/browser-use/pull/1561",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/browser-use/browser-use/releases/tag/0.1.45",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/browser-use/browser-use/security/advisories/GHSA-x39x-9qw5-ghrf",
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@mitre.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-647"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In browser-use (aka Browser Use) before 0.1.45, URL parsing of allowed_domains is mishandled because userinfo can be placed in the authority component."
    },
    {
      "lang": "es",
      "value": "En browser-use (también conocido como Browser Use) anterior a la versión 0.1.45, el análisis de URL de allowed_domains se gestiona incorrectamente porque la información del usuario se puede colocar en el componente de autoridad."
    }
  ],
  "lastModified": "2026-06-17T09:27:37.813",
  "sourceIdentifier": "cve@mitre.org"
}