PT-2022-15047 · Unknown · Onionshare

Micahflee · Published 2022-01-18 · Updated 2024-06-15 · CVE-2022-21695

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions OnionShare versions prior to 2.5

Description OnionShare is an open source tool that lets users securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions, authenticated users (or unauthenticated in public mode) can send messages without being visible in the list of chat participants. This issue allows an adversary with access to the chat environment to send messages to the chat without being visible in the list of chat participants.

Recommendations For OnionShare versions prior to 2.5: Update to version 2.5 to resolve the issue. As a temporary workaround, consider implementing proper session handling and allowing chat access only after emission of the join event. Restrict access to the chat environment to minimize the risk of exploitation.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2022-21695

GHSA-99P8-9P2C-49J4

OPENSUSE-SU-2024:11983-1

OPENSUSE-SU-2024:13635-1

PYSEC-2022-46

Affected Products

Onionshare

References · 29

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21695.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-21695 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-21695 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-21695 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-21695 · Security Note
• https://osv.dev/vulnerability/PYSEC-2022-46 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:13635-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-99p8-9p2c-49j4 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-21695 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-21695 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11983-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-21695 · Vendor Advisory
• https://github.com/onionshare/onionshare/releases/tag/v2.5 · Note
• https://github.com/onionshare/onionshare/security/advisories/GHSA-99p8-9p2c-49j4 · Note
• https://github.com/onionshare/onionshare · Note