PT-2022-15046 · Unknown+1 · Onionshare+1

Micahflee · Published 2022-01-18 · Updated 2024-06-15 · CVE-2022-21694

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions OnionShare (affected versions not specified)

Description The website mode of OnionShare allows the use of a hardened Content Security Policy (CSP), which blocks scripts and external resources. However, this CSP cannot be configured for individual pages, making it unusable for websites that require JavaScript or external resources like fonts or images. This issue is considered a general weakness rather than a direct vulnerability, with a low threat level.

Recommendations

• Consider offering a configurable webserver choice
• Consider configurable CSP At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2022-21694

GHSA-H29C-WCM8-883H

OPENSUSE-SU-2024:11983-1

OPENSUSE-SU-2024:13635-1

PYSEC-2022-45

Affected Products

Debian

Onionshare

References · 30

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21694.json · Exploit
• https://security-tracker.debian.org/tracker/CVE-2022-21694 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-21694 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:13635-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-21694 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h29c-wcm8-883h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21694 · Security Note
• https://ubuntu.com/security/CVE-2022-21694 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-45 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11983-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-21694 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-21694 · Security Note
• https://github.com/onionshare/onionshare/releases/tag/v2.5 · Note
• https://github.com/onionshare/onionshare/security/advisories/GHSA-h29c-wcm8-883h · Note
• https://github.com/onionshare/onionshare/issues/1389 · Note