CVE-2022-21695

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions authenticated users (or unauthenticated in public mode) can send messages without being visible in the list of chat participants. This issue has been resolved in version 2.5.

CVSS v3 4.3 MEDIUM
CVSS v2.0 5.0 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://github.com/onionshare/onionshare/releases/tag/v2.5	Release Notes Third Party Advisory
https://github.com/onionshare/onionshare/security/advisories/GHSA-99p8-9p2c-49j4	Third Party Advisory
https://github.com/onionshare/onionshare/releases/tag/v2.5	Release Notes Third Party Advisory
https://github.com/onionshare/onionshare/security/advisories/GHSA-99p8-9p2c-49j4	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:onionshare:onionshare:*:*:*:*:*:*:*:*

History

21 Nov 2024, 06:45

Type	Values Removed	Values Added
References	~~() https://github.com/onionshare/onionshare/releases/tag/v2.5 - Release Notes, Third Party Advisory~~	() https://github.com/onionshare/onionshare/releases/tag/v2.5 - Release Notes, Third Party Advisory
References	~~() https://github.com/onionshare/onionshare/security/advisories/GHSA-99p8-9p2c-49j4 - Third Party Advisory~~	() https://github.com/onionshare/onionshare/security/advisories/GHSA-99p8-9p2c-49j4 - Third Party Advisory
CVSS	v2 : ~~5.0~~ v3 : ~~5.3~~	v2 : 5.0 v3 : 4.3

Information

Published : 2022-01-18 22:15

Updated : 2024-11-21 06:45

NVD link : CVE-2022-21695

Mitre link : CVE-2022-21695

CVE.ORG link : CVE-2022-21695

JSON object : View

Products Affected

onionshare

onionshare

CWE

CWE-287

Improper Authentication

{"id": "CVE-2022-21695", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2022-01-18T22:15:08.147", "references": [{"url": "https://github.com/onionshare/onionshare/releases/tag/v2.5", "tags": ["Release Notes", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/onionshare/onionshare/security/advisories/GHSA-99p8-9p2c-49j4", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/onionshare/onionshare/releases/tag/v2.5", "tags": ["Release Notes", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/onionshare/onionshare/security/advisories/GHSA-99p8-9p2c-49j4", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-287"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions authenticated users (or unauthenticated in public mode) can send messages without being visible in the list of chat participants. This issue has been resolved in version 2.5."}, {"lang": "es", "value": "OnionShare es una herramienta de c\u00f3digo abierto que permite compartir archivos, alojar sitios web y chatear con amigos de forma segura y an\u00f3nima usando la red Tor. En las versiones afectadas los usuarios autenticados (o no autenticados en modo p\u00fablico) pueden enviar mensajes sin ser visibles en la lista de participantes del chat. Este problema ha sido resuelto en la versi\u00f3n 2.5"}], "lastModified": "2024-11-21T06:45:15.057", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:onionshare:onionshare:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B3A7A46B-5812-492A-B66B-DC43A15A0A38", "versionEndExcluding": "2.5"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}