Vulnerability Details : CVE-2022-21690
Potential exploit
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions The path parameter of the requested URL is not sanitized before being passed to the QT frontend. This path is used in all components for displaying the server access history. This leads to a rendered HTML4 Subset (QT RichText editor) in the Onionshare frontend.
Vulnerability category: Cross site scripting (XSS)
Products affected by CVE-2022-21690
- cpe:2.3:a:onionshare:onionshare:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-21690
0.05%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 24 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-21690
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
3.5
|
LOW | AV:N/AC:M/Au:S/C:N/I:P/A:N |
6.8
|
2.9
|
NIST | |
5.4
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
2.3
|
2.7
|
NIST | |
8.7
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N |
2.3
|
5.8
|
GitHub, Inc. |
CWE ids for CVE-2022-21690
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by:
- nvd@nist.gov (Primary)
- security-advisories@github.com (Secondary)
References for CVE-2022-21690
-
https://github.com/onionshare/onionshare/releases/tag/v2.5
Release OnionShare 2.5 · onionshare/onionshare · GitHubRelease Notes;Third Party Advisory
-
https://github.com/onionshare/onionshare/security/advisories/GHSA-ch22-x2v3-v6vq
OTF-001: Improper Input Sanitation: The path parameter of the requested URL is not sanitized before being passed to the QT frontend · Advisory · onionshare/onionshare · GitHubExploit;Third Party Advisory
Jump to