Lucene search

GitHub_MCVE-2022-21690

HistoryJan 18, 2022 - 11:15 p.m.

CVE-2022-21690

2022-01-1823:15:08

CWE-79

GitHub_M

web.nvd.nist.gov

onionshare

cve-2022-21690

security

file sharing

tor network

vulnerability

web hosting

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

8.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

21.4%

JSON

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions The path parameter of the requested URL is not sanitized before being passed to the QT frontend. This path is used in all components for displaying the server access history. This leads to a rendered HTML4 Subset (QT RichText editor) in the Onionshare frontend.

Affected configurations

Nvd

Vulners

Node

onionshareonionshareRange<2.5

VendorProductVersionCPE
onionshareonionshare*cpe:2.3:a:onionshare:onionshare:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
onionshare	onionshare	*	cpe:2.3:a:onionshare:onionshare::::::::

CNA Affected

[
  {
    "product": "onionshare",
    "vendor": "onionshare",
    "versions": [
      {
        "status": "affected",
        "version": "< 2.5"
      }
    ]
  }
]