CVE-2022-21694
The website mode of the onionshare allows to use a hardened CSP, which will block any scripts and external resources.
Does this matter?
Lower severity and a low EPSS score (1.26%). Track it; it rarely justifies an emergency change on its own.
Description
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. The website mode of the onionshare allows to use a hardened CSP, which will block any scripts and external resources. It is not possible to configure this CSP for individual pages and therefore the security enhancement cannot be used for websites using javascript or external resources like fonts or images.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- EPSS
- 1.26% probability · 68th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-732
- Affected
- onionshare/onionshare
- Source
- security-advisories@github.com
References
- https://github.com/onionshare/onionshare/issues/1389Issue Tracking, Third Party Advisory
- https://github.com/onionshare/onionshare/releases/tag/v2.5Release Notes, Third Party Advisory
- https://github.com/onionshare/onionshare/security/advisories/GHSA-h29c-wcm8-883hThird Party Advisory
- https://github.com/onionshare/onionshare/issues/1389Issue Tracking, Third Party Advisory
- https://github.com/onionshare/onionshare/releases/tag/v2.5Release Notes, Third Party Advisory
- https://github.com/onionshare/onionshare/security/advisories/GHSA-h29c-wcm8-883hThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.