Lucene search

GitHub_MCVE-2022-21696

HistoryJan 18, 2022 - 8:15 p.m.

CVE-2022-21696

2022-01-1820:15:07

CWE-20

GitHub_M

web.nvd.nist.gov

onionshare

file sharing

anonymity

security

chat

tor

cve-2022-21696

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

4.4

Confidence

High

EPSS

0.001

Percentile

19.4%

JSON

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions it is possible to change the username to that of another chat participant with an additional space character at the end of the name string. An adversary with access to the chat environment can use the rename feature to impersonate other participants by adding whitespace characters at the end of the username.

Affected configurations

Nvd

Vulners

Node

onionshareonionshareRange<2.5

VendorProductVersionCPE
onionshareonionshare*cpe:2.3:a:onionshare:onionshare:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
onionshare	onionshare	*	cpe:2.3:a:onionshare:onionshare::::::::

CNA Affected

[
  {
    "product": "onionshare",
    "vendor": "onionshare",
    "versions": [
      {
        "status": "affected",
        "version": "< 2.5"
      }
    ]
  }
]