CVE-2022-21694

EUVD-2022-0185

18.01.2022, 23:15

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. The website mode of the onionshare allows to use a hardened CSP, which will block any scripts and external resources. It is not possible to configure this CSP for individual pages and therefore the security enhancement cannot be used for websites using javascript or external resources like fonts or images.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	3.7 LOW	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
GitHub_M	CNA	3.7 LOW	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 48%

Affected Products (NVD)

Vendor	Product	Version
onionshare	onionshare	𝑥 < 2.5

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

onionshare

bookworm	2.6-5~deb12u1 fixed
bullseye	unimportant
buster	not-affected
sid	2.6.2-4 fixed
trixie	2.6.2-4 fixed

Ubuntu Releases

Ubuntu Product

Codename

onionshare

bionic	needs-triage
focal	needs-triage
impish	ignored
jammy	needs-triage
kinetic	dne
lunar	ignored
mantic	ignored
noble	needs-triage
trusty	ignored
xenial	needs-triage

Common Weakness Enumeration

CWE-732 - Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

References

https://github.com/onionshare/onionshare/issues/1389

https://github.com/onionshare/onionshare/releases/tag/v2.5

https://github.com/onionshare/onionshare/security/advisories/GHSA-h29c-wcm8-883h

https://github.com/onionshare/onionshare/issues/1389

https://github.com/onionshare/onionshare/releases/tag/v2.5

https://github.com/onionshare/onionshare/security/advisories/GHSA-h29c-wcm8-883h